JBoss Remoting RemoteMessageChannel DoS (intrusive check)

A denial of service DoS vulnerability exists in JBoss Remoting due to the way RemoteMessageChannel, introduced in version 3.3.10.Final-redhat-1, reads from an empty buffer. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to cause the JBoss Remoting...

Japanese Government Will Hack Citizens' IoT Devices

The Japanese government is going to run penetration tests against all the IoT devices in their country, in an effort to 1 figure out what's insecure, and 2 help consumers secure them: The survey is scheduled to kick off next month, when authorities plan to test the password security of over 200...

CVE-2019-1652

creationtimestamp| type| source ---|---|--- 2019-01-24 16:19:27+00:00| seen| MISP/5c49e52d-6db8-4f3c-b0c6-4c5b0a021402 2019-01-25 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/46243 2019-01-28 15:19:02+00:00| seen| MISP/5c4f1cd3-4e30-476b-9bf5-1a630a021402 2019-01-29...

Fedora 28 : gnupg2 (2019-e70c729d8a)

Minor update to upstream version 2.2.12 fixing moderate security issue and other bugs. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fallout EK Retools for a Fresh New 2019 Look

A new version of the Fallout exploit kit EK has emerged, featuring new exploits and fresh payloads, including the GandCrab ransomware. The development shows that EKs have a lot of life yet left in them, researchers say. The Fallout EK generally finds its victims by way of malvertising campaigns,...

SUSE-SU-2019:0126-1 Security update for openssh

This update for openssh fixes the following issues: Security issues fixed: - CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions bsc1121571 - CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to...

exploitdb-bin-sploitsss

This is an official repository of The Exploit Database, a project sponsored by Offensive Security. The repository contains a collection of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. It is intended to serve as the...

exploitdbddd

This is an official repository of The Exploit Database, a project sponsored by Offensive Security. The repository contains a collection of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. The Exploit Database is an...

Prices for Zero-Day Exploits Are Rising

Companies are willing to pay ever-increasing amounts for good zero-day exploits against hard-to-break computers and applications: On Monday, market-leading exploit broker Zerodium said it would pay up to $2 million for zero-click jailbreaks of Apple's iOS, $1.5 million for one-click iOS jailbreak...

Fedora 28 : kernel / kernel-headers (2019-509c133845)

The v4.19.15 stable update contains important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

HTTP Response Splitting

ruby is vulnerable to HTTP response splitting. An attacker is able to inject arbitrary data into an HTTP response of the WEBrick server, allowing cross-site scripting attacks, web cache poisoning or similar exploits...

Oracle Critical Patch Update Advisory - January 2019

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories...

Suspicious JavaScript Obfuscation Chunks Technique

Known exploits could potentially bypass security products by using JavaScript obfuscation techniques. Obfuscated exploits might not be detected by IDS and IPS systems, thus allowing attackers to successfully attack the target web client...

Hackers Using Zero-Width Spaces to Bypass MS Office 365 Protection

Security researchers have been warning about a simple technique that cybercriminals and email scammers are already being using in the wild to bypass security features of Microsoft Office 365, including Safe Links, which are originally designed to protect users from malware and phishing attacks...

Emerson DeltaV

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low skill level to exploit Vendor: Emerson Equipment: DeltaV Distributed Control System Workstations Vulnerability: Authentication Bypass 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to shut down a service,...

Pilz PNOZmulti Configurator

1. EXECUTIVE SUMMARY CVSS v3 3.3 ATTENTION: Low skill level to exploit Vendor: Pilz GmbH & Co. KG Pilz Equipment: PNOZmulti Configurator Vulnerability: Clear-text Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow sensitive data to be...

Container Security Becomes a Priority for Enterprises

Among the IT innovations that businesses are using to digitally transform operations, containers might be the most disruptive and revolutionary. “They’re a real game changer,” Qualys Chief Product Officer Sumedh Thakar said at QSC 2018 in Las Vegas. DevOps teams have embraced containers because...

Patch Tuesday, January 2019 Edition

Microsoft on Tuesday released updates to fix roughly four dozen security issues with its Windows operating systems and related software. All things considered, this first Patch Tuesday of 2019 is fairly mild, bereft as it is of any new Adobe Flash updates or zero-day exploits. But there are a few...

The State of Web Application Vulnerabilities in 2018

Jan. 12 update: Due to a data transfer error, some of the 2017 figures were incorrectly reported; this version of the blog has been corrected. This error did not affect our 2018 statistics, nor our conclusions. As a web application firewall provider, part of our job at Imperva is to continually...

Zerodium is paying $2 million for Apple iOS remote jailbreak

By Waqas Zerodium, an infosec and premium zero-day acquisition platform known for selling zero-day exploits to governments has announced that it will be paying a huge amount of money to buy iOS remote jailbreak and exploits related to WhatsApp, iMessage, or SMS/MMS. See: Zerodium uses Twitter to...