7195 matches found
MariaDB 5.5.0 < 5.5.30 Multiple Vulnerabilities
The version of MariaDB installed on the remote host is prior to 5.5.30. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.30 advisory. - Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticat...
Attackers Shifting to Delivering Unknown Malware Via FTP and Web Pages
The bulk of “unknown” malware is being delivered to systems via Web-based attacks, proxies and FTP sessions, according to a study released by Palo Alto Networks this week. The study dubbed “The Modern Malware Review,” found more than 26,000 malware samples, and focuses on what the firm calls...
WordPress Plugin Banners Lite - wpbanners_show.php HTML Injection
WordPress Plugin Banners Lite - wpbannersshow.php HTML Injection source: https://www.securityfocus.com/bid/58671/info The Banners Lite plugin for WordPress is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Successful exploits will allow...
VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "OnMove" Use-after-free (MS13-021 / CVE-2013-0087)
VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "OnMove" Use-after-free MS13-021 / CVE-2013-0087 Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included...
Why Watering Hole Attacks Work
Information security is littered with bad analogies. And none sounds sillier than a watering hole attack, which plays off the tactic that dominant animals use when stalking food by loitering at a watering hole. Rather than chase their prey, a lion will wait for prey to come to it. Hackers are doi...
Internet Explorer 8 Exploit Found in Watering Hole Campaign Targeting Chinese Dissidents
On March 16th, we discovered a premeditated waterhole campaign that hosts exploits and malware on websites frequented by a specific target group. In this case the target includes Chinese dissidents. For the attacker, this approach is highly attractive since it is very difficult to discover the...
Google Serves Up a Half Slice of Pwnium Cash for Pinkie Pie
Depending upon your perspective, the third iteration of Google Pwnium at this year’s CanSecWest conference was either a mild failure or a huge success. No researchers were able to come up with a full compromise of the Chrome OS, the target in this year’s contest, but Google said this week that it...
Attack Exploits Weakness in RC4 Cipher to Decrypt User Sessions
It’s been more than 25 years since Ron Rivest invented his RC4 stream cipher, and after all that time it’s still being used widely, which is something of an achievement in the crypto world. However, for more than 15 years researchers have known about a weakness in RC4 that could enable an attacke...
Adobe Fixes Four Critical Flaws in Flash
Adobe on Tuesday fixed four critical vulnerabilities in its Flash software, all of which could be used by attackers to execute code on vulnerable machines. While the monthly updates for Adobe products don’t necessarily draw as much attention as those from Microsoft, they often can be more...
New Web-Based MiniDuke Components Discovered
Researchers at Kaspersky Lab and CrySys Lab have discovered files buried inside a MiniDuke command and control server that indicate the presence of a Web-based facet of the campaign that initially targeted government agencies, primarily in Europe. Users are likely lured to the malicious webpages...
More from CanSecWest 2013
Pwn2Own, Pwnium Attract Dollars and 0-Days by the Bushel Groundbreaking Cyber Fast Track Research Program Ending At Pwn2Own, Browser Exploits Getting Harder, More Expensive to Find Firefox, Java, Flash All Taken Down at Pwn2Own How Facebook Prepared to Be Hacked...
Chrome, Firefox, Java, IE10 exploited at Pwn2Own competition
During the first day of Pwn2Own competition at the CanSecWest conference in Vancouver , latest versions of all major browsers were exploited by hackers. Chrome, Firefox and Internet Explorer 10 on Windows 8 were successfully pwned by various competitors, bringing them tens of thousands of dollars...
At Pwn2Own, Browser Exploits Getting Harder, More Expensive to Find
VANCOUVER–The Pwn2Own contest has evolved in many ways over the years, from new rules to new targets to larger prizes, but perhaps the one thing that has changed the most is that the researchers who show up here every year hoping to go home with a bag full of money are having to spend more and mo...
Pwn2Own, Pwnium Attract Dollars and 0-Days by the Bushel
The new year is barely two months old and it’s already been a brutal one for the disclosure of new vulnerabilities. Java, Adobe Reader, Flash, Google Chrome and a number of other widely deployed applications have all been hit with a slew of serious bugs in just the last few weeks. And that’s like...
VUPEN Security Research - Microsoft Windows OLE Automation Code Execution Vulnerability
VUPEN Security Research - Microsoft Windows OLE Automation Remote Code Execution Vulnerability Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Microsoft Windows is a series of software operating systems and graphical user interfaces produced b...
SuSE 11.2 Security Update : flash-player (SAT Patch Number 7431)
flash-player has been updated to 11.2.202.273 security update, which fixes several critical security bugs that could have been used by remote attackers to execute code. CVE-2013-0504 / CVE-2013-0643 / CVE-2013-0648 More information can be found on :...
Software Security Programs May Not Be Worth the Investment for Many Companies
SAN FRANCISCO–The discipline of software security has been gaining traction in a lot of organizations both large and small in recent years, thanks in part to the success that vendors such as Microsoft, Adobe and others have had with it. However, for many companies, the time and money spent on...
MiniDuke Espionage Malware Hits Governments in Europe Using Adobe Exploits
New espionage malware has been discovered that targets a patched sandbox-bypass vulnerability in Adobe Reader. The attacks have hit a relatively small number of government victims in 23 countries, primarily in Europe, and rely on a string of unusual tactics, including the use of steganography to...
MS KB2819372: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10
The remote host is missing KB2819372. It may, therefore, be affected by the following vulnerabilities related to the installed version of the Adobe Flash ActiveX control : - A buffer overflow error exists related to the 'broker service'. CVE-2013-0504 - An unspecified error exists related to...
SuSE 10 Security Update : acroread (ZYPP Patch Number 8474)
Acrobat Reader was updated to 9.5.4 which fixes two critical security issues where attackers supplying PDFs could have caused code execution with acrobat. CVE-2013-0640 / CVE-2013-0641 More information can be found on : https://www.adobe.com/support/security/bulletins/apsb13-07.html %NASLMINLEVEL...