Security Updates for Microsoft Word Products (January 2018)

The Microsoft Words Products are missing security updates. It is therefore affected by multiple issues involving handling of Office and RTF Rich Text Format files. If successfully exploited, an attacker could execute code in the context of the current user. C Tenable Network Security, Inc...

KLA11170 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface and obtain sensitive information. Below is a complete list of vulnerabilities: 1. Elevation of privilege vulnerabilities in...

KLA11173 OSI vulnerability in VMware Products

A bounds check bypass and branch target injection vulnerability was found in VMware ESXi, VMWare Workstation and VMware Fusion. By exploiting this vulnerability malicious users can obtain sensitive information. Original advisories VMSA-2018-0004 VMSA-2018-0002 Exploitation Public exploits exist f...

Microsoft Office CVE-2018-0801 Remote Code Execution Vulnerability

Description Microsoft Office is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected Microsoft...

Experts Weigh In On Spectre Patch Challenges

The race to patch against the Meltdown and Spectre processor vulnerabilities disclosed last week is on. As of today, there are no known exploits in the wild impacting vulnerable Intel, AMD and ARM devices. Currently, vendors are focused on three main mitigation efforts. Patches that address the...

Ayukov NFTP FTP Client 2.0 - Buffer Overflow Exploit

Exploit for windows platform in category remote exploits...

Citrix XenServer Multiple Vulnerabilities (CTX231390) (Meltdown)(Spectre)

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid105617; scriptversion"1.12";...

MGASA-2018-0048 Updated libxml2 & perl-XML-LibXML packages fix security vulnerabilities

Use-after-free error could lead to crash CVE-2016-4658. Use-after-free vulnerability in libxml2 through 2.9.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function CVE-2016-5131. libxml2 2.9.4 and earli...

KLA11166 Multiple vunlerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability in...

Joomla EXP Auto 4.2.3 SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Joomla EXP Auto 4.2.3 - SQL Injection Credit: Bilal KARDADOU Vendor: http://www.feellove.eu/ URL: https://extensions.joomla.org/extensions/extension/vertical-markets/vehicles/exp-auto/ Product: 'Joomla EXP Auto 4.2.3' Developer: Grusha...

CVE-2017-10271

creationtimestamp| type| source ---|---|--- 2018-01-03 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43458 2018-01-05 00:56:53+00:00| seen| MISP/5a4ecbf4-1b24-4a5f-9f4d-4b7c98036464 2018-01-15 08:45:17+00:00| seen| MISP/5a5c6952-5540-46e5-b61f-6f2eac1f1623 2018-01-29...

BlueMaho v090417 - Bluetooth Security Testing Suite

BlueMaho is GUI-shell interface for suite of tools for testing security of bluetooth devices. It is freeware, opensource, written on python, uses wxPyhon. It can be used for testing BT-devices for known vulnerabilities and major thing to do - testing to find unknown vulns. Also it can form nice...

The State of Web Application Vulnerabilities in 2017

As a web application firewall provider, part of our job at Imperva is constantly monitoring new security vulnerabilities. To do this, we use internal software that collects information from various data sources such as vulnerability databases, newsletters, forums, social media and more, integrate...

Security Round-up: Five Things We’ve Learned in 2017

The past 12 months have been packed with geopolitical incidents, global malware threats and ubiquitous big-name data breaches. From the CIA Vault7 and NSA Shadow Brokers leaks at the start of the year, to the WannaCry and NotPetya ‘ransomware’ campaigns, and Uber’s shocking revelations just last...

XAttacker - Website Vulnerability Scanner & Auto Exploiter

XAttacker is a Website Vulnerability Scanner & Auto Exploiter developed by Mohamed Riahi Installation git clone https://github.com/Moham3dRiahi/XAttacker.git Auto Cms Detect 1 WordPress : + Adblock Blocker + WP All Import + Blaze + Catpro + Cherry Plugin + Download Manager + Formcraft +...

Security Bulletin: NVIDIA Linux for Tegra (L4T) “KRACK” vulnerabilities

Vulnerability Details The following section summarizes the vulnerabilities. Descriptions use CWE™ and risk assessments follow CVSS. CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088 L4T ships with a...

Ecava IntegraXor

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Ecava Equipment: IntegraXor Vulnerabilities: SQL Injection AFFECTED PRODUCTS The following version of IntegraXor, a web SCADA/HMI solution, is affected: Ecava IntegraXor v 6.1.1030.1 and prior. IMPACT Successful...

JexBoss - JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool

JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server and others Java Platforms, Frameworks, Applications, etc. Requirements Python = 2.7.x urllib3 ipaddress Installation on Linux\Mac To install the latest version of JexBoss, please use the following commands: g...

CVE-2017-17562

creationtimestamp| type| source ---|---|--- 2017-12-18 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43360 2017-12-18 23:10:28+00:00| published-proof-of-concept| https://t.me/antichat/456 2018-01-24 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43877 2018-05-29...

Operation Dragonfly Analysis Suggests Links to Earlier Attacks

ARCHIVED STORY Operation Dragonfly Analysis Suggests Links to Earlier Attacks By Trellix · December 17, 2017 On September 6, Symantec published details of the Dragonfly campaign, which targeted dozens of energy companies throughout 2017. This attack was effectively Dragonfly 2.0, an update to a...