Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Google Android

This is a proof-of-concept PoC exploit for CVE-2016-5696, an o...

Leaked Exploits are Legit and Belong to NSA: Cisco, Fortinet and Snowden Docs Confirm

Last week, a group calling itself "The Shadow Brokers" published what it said was a set of NSA "cyber weapons," including some working exploits for the Internet's most crucial network infrastructure, apparently stolen from the agency's Equation Group in 2013. Well, talking about the authenticity ...

Cisco Acknowledges ASA Zero Day Exposed by ShadowBrokers

Cisco has quickly provided a workaround for one of two vulnerabilities that was disclosed in the ShadowBrokers’ data dump and issued an advisory on the other, which was patched in 2011, in order to raise awareness among its customers. The networking giant today released advisories saying that it...

ShadowBrokers' Leak Has 'Strong Connection' to Equation Group

A high-stakes game of attribution started by a group claiming to have a cache of exploits belonging to the Equation Group took a somewhat definitive turn Tuesday afternoon. Researchers at Kaspersky Lab yesterday confirmed a connection between the tools currently up for auction by the ShadowBroker...

Linux device TCP connection exposure to high-risk vulnerabilities: as long as the access network might be attack-vulnerability warning-the black bar safety net

Generally, we would think, to confirm on the Internet any two whether the host device to establish a TCP connection Newsletter, in fact, is not easy--the attacker if not both sides of the communication path, it is even more so. In addition, if the attacker is not in the communication path to be...

Putting Apple Bug Bounty Rewards in Perspective

Admittedly, the payouts for Apple’s bug bounty announced last week at Black Hat drew mixed reactions ranging from reasonable to raucously funny. Apple made a big splash at the annual hacker conference, first via a last-minute announcement that well-regarded Ivan Krstic would be giving a talk on...

SUSE-SU-2016:2007-1 Security update for Linux Kernel Live Patch 3 for SLE 12 SP1

This update for the Linux Kernel 3.12.53-6030 fixes the several issues. These security issues were fixed: - CVE-2016-4470: The keyrejectandlink function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a...

SUSE-SU-2016:2011-1 Security update for Linux Kernel Live Patch 6 for SLE 12 SP1

This update for the Linux Kernel 3.12.59-6045 fixes the several issues. These security issues were fixed: - CVE-2016-4470: The keyrejectandlink function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a...

SUSE-SU-2016:2006-1 Security update for Linux Kernel Live Patch 12 for SLE 12

This update for the Linux Kernel 3.12.55-5242 fixes several issues. The following security bugs were fixed: - CVE-2016-4470: The keyrejectandlink function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a...

Microsoft Internet Explorer and Edge CVE-2016-3329 Information Disclosure Vulnerability

Description Microsoft Internet Explorer and Edge are prone to an information-disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Edge and Internet explorer 9, 10 and 11 are vulnerable. Technologies Affected Microsoft...

KLA11908 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. An elevation...

KLA10857 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to obtain sensitive information or execute arbitrary code. Below is a complete list of vulnerabilities 1. An improper memory contents handling at OneNote can be exploited remote...

KLA10858 Multiple vulnerabilities in Microsoft Edge and Internet Explorer

Multiple serious vulnerabilities have been found in Microsoft Internet Explorer and Edge. Malicious users can exploit these vulnerabilities to execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. An improper memory objects handling can be exploite...

Microsoft Internet Explorer and Edge CVE-2016-3326 Information Disclosure Vulnerability

Description Microsoft Internet Explorer and Edge are prone to an information-disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Edge and Internet explorer 9, 10 and 11 are vulnerable. Technologies Affected Microsoft...

Microsoft OneNote CVE-2016-3315 Information Disclosure Vulnerability

Description Microsoft OneNote is prone to an information-disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft OneNote 2007 SP3 Microsoft OneNote 2010 Service Pack 2 32-bit editions...

Microsoft Windows Graphics Component CVE-2016-3304 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits may allow an attacker to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Live Meeting...

Microsoft Internet Explorer and Edge CVE-2016-3327 Information Disclosure Vulnerability

Description Microsoft Internet Explorer and Edge are prone to an information-disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Edge and Internet explorer 9, 10 and 11 are vulnerable. Technologies Affected Microsoft...

WebNMS Framework 5.2 SP1 Traversal / Weak Obfuscation / User Impersonation

Multiple vulnerabilities in WebNMS Framework Server 5.2 and 5.2 SP1 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 04/07/2016 / Last updated: 08/08/2016 Background on the affected...

SecNews: Querying private posts and changing post meta

Summary --- Unauthenticated user can run arbitrary post queries and insert arbitrary numeric post meta via vulnerable /wp-content/themes/SecNews-NewCustom/functions/ajax.php file. I'm including two exploits in one report because the fix for both is the same, i.e. delete ajax.php. Run arbitrary po...

CVE-2014-9874

Buffer overflow in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 5X, 6P, and 7 2013 devices allows attackers to gain privileges via a crafted application, related to arch/arm/mach-msm/qdsp6v2/audioutils.c and sound/soc/msm/qdsp6v2/q6asm.c, aka Android internal bug 28751152 and...