CVE-2017-2211

CVE-2017-2211 affects PatchJGD (Hyoko) installer PatchJGDh101.EXE 1.0.1. The issue is an untrusted search path that can lead to Trojan horse DLL loading, allowing privilege elevation. Impact described as arbitrary code execution with user privileges when invoking the installer. The problem is tie...

Keylogger Found in Audio Drivers on Some HP Machines

An audio driver that comes installed on some HP-manufactured computers records users’ keystrokes and stores them in a world-readable plaintext file, researchers said Thursday. The culprit appears to be version 1.0.0.31 of MicTray64.exe, a program that comes installed with the Conexant audio drive...

SAP GUI regsvr32.exe Rule Security Policy Bypass (CVE-2017-6950)

A security policy bypass vulnerability has been reported in SAP GUI. The vulnerability is due to improper implementation of client side security policies regarding the Windows application regsvr32.exe. A remote attacker could exploit this vulnerability by enticing an user to connect to a maliciou...

NSA Eternalblue SMB vulnerability analysis-vulnerability warning-the black bar safety net

Environment TROJAN: Eternalblue-2.2.0.exe TARGET: win7 sp1 32bits srv.sys 6.1.7601.17514 srvnet.sys 6.1.7601.17514 PATCH: MS17-010 The vulnerability principle srv. sys in the processing SrvOs2FeaListSizeToNt when logic is incorrect resulting in cross-border copy. We first look at the vulnerabilit...

HTTP Protocol Remote Code Execution

A remote code execution vulnerability exists in HTTP protocol. By sending a request containing a specially crafted EXE file, a remote attacker can exploit this vulnerability in order to execute arbitrary code on the effected system...

Updated icoutils packages fix security vulnerability

Multiple vulnerabilities were discovered in the icotool CVE-2017-6010, CVE-2017-6011 and wrestool CVE-2017-6009 tools of icoutils, a set of programs that deal with MS Windows icons and cursors, which may result in denial of service or the execution of arbitrary code if a malformed .ico or .exe fi...

DeepService SSL VPN suffers from a local power lifting vulnerability

EasyConnect enables you to use all the systems and applications on your company's intranet outside the office. The EasyConnect PC Client version 7.1.0.4 has an exe hijacking vulnerability due to a space in the binary path Program Files and the entire path is not enclosed in double quotes, which...

EasyCom SQL iPlug Denial Of Service

Credits: John Page AKA Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EASYCOM-SQL-IPLUG-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: ================ easycom-aura.com Product: =========== SQL iPlug EasycomPHP4.0029.iC8im2.exe SQL iPlug...

Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government

Introduction FireEye recently observed a sophisticated campaign targeting individuals within the Mongolian government. Targeted individuals that enabled macros in a malicious Microsoft Word document may have been infected with Poison Ivy, a popular remote access tool RAT that has been used for...

CVE-2016-7086

The installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to gain privileges via a Trojan horse setup64.exe file in the installation directory...

CVE-2016-7086

The installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to gain privileges via a Trojan horse setup64.exe file in the installation directory...

CVE-2016-7086

The CVE-2016-7086 issue affects VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows. The root cause is a Trojan horse setup64.exe placed in the installation directory, enabling local privilege escalation for attackers with local access. The public...

CVE-2016-10072

WampServer 3.0.6 has two files called 'wampmanager.exe' and 'unins000.exe' with a weak ACL for Modify. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local...

Threat Outbreak Alert RuleID26986: Email Messages Distributing Malicious Software on December 20, 2016

Medium Alert ID: 52174 First Published: 2016 December 20 16:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID26986 may contain the following files: Name |...

Threat Outbreak Alert RuleID26877: Email Messages Distributing Malicious Software on December 19, 2016

Medium Alert ID: 52147 First Published: 2016 December 19 18:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID26877 may contain the following files: Name |...

Microsoft MSINFO32.EXE 6.1.7601 - .NFO XML External Entity Injection Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ================= www.microsoft.com Product: ========================== Windows System Information MSINFO32.exe v6.1.7601 Windows MSINFO32.EXE Displays a comprehensive view of your hardware, system...

Microsoft MSINFO32.EXE 6.1.7601 - .NFO XML External Entity Injection

Microsoft MSINFO32.EXE 6.1.7601 - .NFO XML External Entity Injection + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-MSINFO32-XXE-FILE-EXFILTRATION.txt + ISR: ApparitionSec Vendor: =================...

Microsoft MSINFO32.EXE 6.1.7601 - '.NFO' XML External Entity Injection

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-MSINFO32-XXE-FILE-EXFILTRATION.txt + ISR: ApparitionSec Vendor: ================= www.microsoft.com Product: ========================== Windows System Information...

Threat Outbreak Alert RuleID25812: Email Messages Distributing Malicious Software on November 15, 2016

Medium Alert ID: 49716 First Published: 2016 November 15 17:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID25812 may contain the following files: Name |...

Overlayfs Privilege Escalation Exploit

Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "msf/core" class MetasploitModule 'Overlayfs Privilege Escalation', 'Description' = %q This module attempts...