7229 matches found
openSUSE Security Update : perl (openSUSE-2018-751)
This update for perl fixes the following issues : - CVE-2018-12015: The Archive::Tar module allowed remote attackers to bypass a directory-traversal protection mechanism and overwrite arbitrary files bsc1096718 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 703...
Unicorn Suspicious Evasion Technique
Known exploits could potentially bypass security products by using Unicorn tool obfuscation techniques. Successful exploitation of this issue may allow execution of arbitrary code on a vulnerable system...
Oracle Sets All-Time Record with July Critical Patch Update
Oracle has released a massive Critical Patch Update CPU for July, addressing 334 security vulnerabilities covering a vast swathe of its enterprise portfolio. Of the 334 vulnerabilities covered this month, 61 are rated critical, with a CVSS rating between nine and 10. Oracle said in its advisory...
Cybercrime tactics & techniques Q2 2018
A generally slow quarter reflects an overall lull in cybercrime, picking up where Q1 left off with cryptominers continuing to dominate, ransomware continuing to evolve through experimentation, and exploits making a small but significant comeback. In nearly every malware category for both business...
CPU July 2018
A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories...
macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-004)
The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111136; scriptversion"1.10";...
Magniber ransomware improves, expands within Asia
This blog post was authored by @hasherezade and Jérôme Segura. The Magnitude exploit kit is one of the longest-serving browser exploitation toolkits among those still in use. After its inception in 2013, it enjoyed worldwide distribution with a liking for ransomware. Eventually, it became a priva...
exploit-database
This is an official repository of The Exploit Database, a project sponsored by Offensive Security. The repository contains a collection of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. The aim is to serve as the most...
exploit-database-bin-sploits
This is an official repository of The Exploit Database, a project sponsored by Offensive Security. The repository contains a collection of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. The aim is to serve as the most...
Adobe Releases Security Patch Updates For 112 Vulnerabilities
Adobe has released security patches for a total 112 vulnerabilities in its products, most of which have a higher risk of being exploited. The vulnerabilities addressed in this month's patch Tuesday affect Adobe Flash Player, Adobe Experience Manager, Adobe Connect, Adobe Acrobat, and Reader. None...
Microsoft Edge CVE-2018-8289 Information Disclosure Vulnerability
Description Microsoft Edge is prone to an information disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Edge Recommendations Run all software as a nonprivileged user with minimal acce...
Sn1per v5.0 - Automated Pentest Recon Scanner
Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage...
Gitea 1.4.0 - Remote Code Execution
pip install PyJWT requests pip install dulwich==0.19.0 from requests import Request, Session, get, post import jwt import time import base64 import os import re import time import threading import random import string import urlparse import urllib from dulwich import porcelain print "Gitea 1.4.0"...
Two Zero-Day Exploits Found After Someone Uploaded 'Unarmed' PoC to VirusTotal
Security researchers at Microsoft have unveiled details of two critical and important zero-day vulnerabilities that had recently been discovered after someone uploaded a malicious PDF file to VirusTotal, and get patched before being used in the wild. In late March, researchers at ESET found a...
Nagios XI Chained Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nagios XI Chained Remote Code Execution', 'Description' = %q This module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to ga...
My Little FormBook
This blog post is authored by Warren Mercer and Paul Rascagneres. Summary Cisco Talos has been tracking a new campaign involving the FormBook malware since May 2018 that utilizes four different malicious documents in a single phishing email. FormBook is an inexpensive stealer available as "malwar...
GLSA-201806-07 : Transmission: Remote code execution
The remote host is affected by the vulnerability described in GLSA-201806-07 Transmission: Remote code execution A vulnerability was discovered in how Transmission handles access control through the X-Transmission-Session-Id. Impact : A remote attacker could execute arbitrary RFC commands or...
Webcast Replay: Preventing Vulnerability Exposure with IBM Security Bulletins
Abstract As the basis for many of IBM's enterprise products, WebSphere Application Server and its runtime often serves as the first line of defense when it comes to IT security. Learn how to ensure that you stay protected against known exploits through effective use of IBM's Security Bulletins...
VPNFilter malware still making waves
Last month, a piece of malware called VPNFilter caused chaos for owners of MikroTik, Lynksys, TP-Link, and Netgear equipment. Roughly 500,000 devices worldwide fell victim, with the unwanted parasite able to listen to traffic, steal credentials, damage devices, and more. Until patches started to...