Pocket Patches Data Exfiltration Vulnerabilities

Developers with Pocket recently fixed vulnerabilities that could have allowed users to exfiltrate data from the company’s servers, including sensitive information regarding web services, internal IP addresses and more. Pocket, formerly known as Read it Later, is an online bookmarking app that...

Flash Broker-Based Sandbox Escape via Timing Attack Against File Moving Exploit

Exploit for windows platform in category remote exploits...

CVE-2015-3118

creationtimestamp| type| source ---|---|--- 2015-08-19 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/37848...

Apple OS X Zero Day Remains Unpatched

A recently disclosed kernel-level zero-day vulnerability in Mac OS X Yosemite and Mavericks remains unpatched, though reports say Apple is developing and testing a patch. Luca Todesco, an 18-year-old security researcher from Italy, on Sunday dropped details and proof-of-concept code about the...

CVE-2016-3088

creationtimestamp| type| source ---|---|--- 2015-08-17 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/40857 2017-06-29 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/42283 2018-05-29 15:50:33+00:00| seen|...

CVE-2015-1830

creationtimestamp| type| source ---|---|--- 2015-08-17 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/40857 2020-03-05 15:12:36+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apacheactivemqtraversalupload.rb 2020-03-09...

Stagefright Patch Incomplete Leaving Android Devices Still Exposed

Google today released to open source a new patch for the infamous Stagefright vulnerability found in 950 million Android devices after researchers at Exodus Intelligence discovered the original patch was incomplete and Android devices remain exposed to attack. “We’ve already sent the fix to our...

Multi Recon Local Exploit Suggester

This module suggests local meterpreter exploits that can be used. The exploits are suggested based on the architecture and platform that the user has a shell opened as well as the available exploits in meterpreter. It's important to note that not all local exploits will be fired. Exploits are...

Huge Flash Update Patches More Than 30 Vulnerabilities

Adobe has released a massive update for Flash, the application that has become the Internet’s problem child. The update contains patches for more than 30 vulnerabilities in Flash on Windows, OS X, and Linux. Adobe pushed out the fixes on Tuesday afternoon, the latest in a long series of fixes for...

KLA10650 Multiple vulnerabilities in Adobe products

Multiple serious vulnerabilities have been found in Adobe products. Malicious users can exploit these vulnerabilities to cause denial of service or execute arbitrary code. Below is a complete list of vulnerabilities 1. Type confusion, use-after-free, multiple overflows and memory corruption could...

Microsoft Windows OpenType Fonts CVE-2015-2432 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits allow attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. Technologies Affected Microsoft Window...

KLA10645 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper memory objects handling can be exploited remotely via a...

Darkhotel APT Latest to Use Hacking Team Zero Day

The fallout from the HackingTeam data dump shows no signs of abating. Since the controversial surveillance software maker was hacked and 400 Gb of its data posted online in early July, a handful of zero-day vulnerabilities and exploits were publicly leaked and continue to find their way into the...

Automate Security Audit: netool.sh

Netool is a toolkit written in bash, python and ruby and provides easy automation for frameworks like Nmap, Driftnet, Sslstrip, Metasploit and Ettercap – mostly MitM attacks. This toolkit makes tasks as SNIFFING tcp/udp traffic, Man-In-The-Middle attacks, SSL-sniff, DNS-spoofing, D0S attacks in...

Researchers to Share Details of Cyber-Terrorists Targeting Indian Government Officials

The Potential threat, range from very narrow to very broad, posed by Cyber-Terrorism has provoked considerable alarm. Terrorists involved in Cyber Espionage and Operations aim at gaining access to Nation's critical infrastructure involving both Government as well as Private sectors. The Frequency...

Firefox ESR < 38.1.1 PDF Reader Arbitrary File Access

The version of Firefox ESR installed on the remote Windows host is prior to 38.1.1. It is, therefore, affected by a vulnerability in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to...

Format string exploits, Part 1-the vulnerability warning-the black bar safety net

Format string vulnerabilities are a class allows an attacker at an arbitrary memory address to perform read or write operations of the software defects. This tutorial is the main concern of the C programming the program and for the formatted string function to use. Before we start understanding...

Firefox < 39.0.3 PDF Reader Arbitrary File Access (Mac OS X)

The version of Firefox installed on the remote Mac OS X host is prior to 39.0.3. It is, therefore, affected by a vulnerability in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitiv...

Emissary Panda APT Group Gets Selective About Data it Steals

LAS VEGAS – The Emissary Panda APT group has a long history of invading Western organizations—be they enterprises, government or political outfits—hungry for reams of intellectual property. Lately the group, however, has become a little more selective about what it steals. Researchers at Dell...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2700-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2700-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable Networ...