7228 matches found
SecNews: Querying private posts and changing post meta
Summary --- Unauthenticated user can run arbitrary post queries and insert arbitrary numeric post meta via vulnerable /wp-content/themes/SecNews-NewCustom/functions/ajax.php file. I'm including two exploits in one report because the fix for both is the same, i.e. delete ajax.php. Run arbitrary po...
CVE-2014-9874
Buffer overflow in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 5X, 6P, and 7 2013 devices allows attackers to gain privileges via a crafted application, related to arch/arm/mach-msm/qdsp6v2/audioutils.c and sound/soc/msm/qdsp6v2/q6asm.c, aka Android internal bug 28751152 and...
Silurus Classifieds 2.0 Cross Site Scripting
Title: Silurus Classifieds XSS Vulnerability Software : Silurus Classifieds Software Version : v2.0 Vendor: http://snowhall.com/slides/silurus Vulnerability Published : 2016-07-25 Author：zhiweijiang Email:[email protected] Impact : MediumCVSS2 Base : 4.3, AV:N/AC:M/Au:N/C:N/I:P/A:N Bug...
Juniper Junos FreeBSD libc db Information Disclosure (JSA10756)
According to its self-reported version number, the remote Juniper Junos device is affected by an information disclosure vulnerability in the underlying FreeBSD operating system libc db interface due to improper initialization of memory for Berkeley DB 1.85 database structures. A local attacker ca...
Sonatype Nexus Repository Manager < 2.11.2 RCE Vulnerability
Sonatype Nexus Repository Manager is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Oracle Fixes 276 Vulnerabilites in July Critical Patch Update
Oracle has one-upped itself once again. The company fixed a record 276 vulnerabilities – more than half of which are remotely exploitable – as part of its July Critical Patch Update released Tuesday afternoon. The quarterly patch update resolves vulnerabilities in 84 different products, including...
Fedora 23 : python (2016-a0853405eb)
Security fix for CVE-2016-0772 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...
KLA10839 Multiple vulnerabilities in Adobe Flash Player
Multiple serious vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information and possibly cause denial of service. Below is a complete list of vulnerabilities 1. Race condition and lack of...
Microsoft Edge and Internet Explorer CVE-2016-3277 Information Disclosure Vulnerability
Description Microsoft Edge and Internet Explorer are prone to a information-disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Edge Microsoft Internet Explorer 10 Microsoft Internet...
KLA10838 Multiple vulnerabilities in Adobe Acrobat & Reader
Multiple serious vulnerabilities have been found in Adobe products. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions or cause a denial of service. Below is a complete list of vulnerabilities 1. Integer overflow, use-after-free, buffer...
'Dropping Elephant' APT Attackers Targets Old Windows Flaws
Don’t judge an APT by its exploits alone. That’s the takeaway from a report that details a unique advanced persistent threat that leverages a kludge of unsophisticated, outdated and rudimentary attack tools to conduct cyber espionage. The target of the attacks are government and diplomatic agenci...
The vulnerability in Microsoft.NET Framework software allows a malicious attacker to compromise the confidentiality of protected information.
Vulnerability exists in the Microsoft .NET Framework, and it allows attackers to circumvent the ASLR protection mechanism, which safeguards users against a wide range of vulnerabilities. Simply bypassing the protection mechanism itself does not allow the execution of arbitrary code. However,...
WebCalendar 1.2.7 - Multiple Vulnerabilities
Exploit for php platform in category web applications + Credits: John Page aka HYP3RLINX + ISR: ApparitionSec Vendor: ========================== www.k5n.us/webcalendar.php Product: ================== WebCalendar v1.2.7 WebCalendar is a PHP-based calendar application that can be configured as a...
This Android Hacking Group is making $500,000 per day
Own an Android smartphone? Hackers can secretly install malicious apps, games, and pop-up adverts on your smartphone remotely in order to make large sums of money. Security researchers at Cheetah Mobile have uncovered one of the world's largest and most prolific Trojan families, infecting million...
Symantec AntiVirus - Unpacking RAR Multiple Remote Memory Corruptions
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=810 A major component of the Symantec Antivirus scan engine is the "Decomposer", responsible for unpacking various archive formats such as ZIP, RAR, and so on. The decomposer runs as NT AUTHORITY\SYSTEM on Windows, and root on Linu...
Dozens of Malicious Apps on Play Store can Root & Hack 90% of Android Devices
It's not at all surprising that the Google Play Store is surrounded by a large number of malicious apps that has the ability to gain users' attention into falling victim for one, but this time, it is even worse than most people realize. Researchers at Trend Micro have detected a family of malicio...
Google's Android Rewards Program Pays Out Half Million in First Year
Google wrapped up the first year of its Android Security Rewards program this week, a span of time that saw the company pay out just north of half a million dollars to security researchers who helped identify vulnerabilities in the mobile operating system. In all, the company paid 82 researchers ...
KLA10830 Multiple vulnerabilities in Adobe Flash Player
Multiple serious vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Type confusion, use-after-free, heap...
Patched BadTunnel Windows Bug Has 'Extensive' Impact
Among the more than three dozen vulnerabilities Microsoft patched on Tuesday was a fix for a bug that the researcher who found it said has “probably the widest impact in the history of Windows.” “There were also some wide impact vulnerabilities before, but maybe not like this extensive,” Chinese...