Oracle Java SE Multiple Vulnerabilities (June 2012 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is earlier than 7 Update 5 / 6 Update 33 / 5.0 Update 36 / 1.4.238 and is, therefore, potentially affected by security issues in the following components : - 2D - Deployment - Hotspot - Swing - CORBA -...

NBC Website Hacked, Leading Visitors to Citadel Banking Malware

Another day, another media company hacked. This time it’s NBC which has fallen to victim hackers on the heels of compromises of the New York Times and Wall Street Journal websites. Various experts have confirmed that NBC’s website is compromised and leading visitors to the dangerous Citadel banki...

Avoid The Attack Attribution Distraction

Plenty has been written this month about attack attribution, but, really, if your network is under siege, how often does the “who” matter as much as the “how,” “what,” and “where”? It seems that knowing who the actor is behind a network intrusion matters little to a bank, restaurant or retail...

Patch released for critical Adobe vulnerabilities

Today Adobe released a patch for two critical vulnerabilities CVE-2013-0640 and CVE-2013-0641 that are already being exploited by attackers. Adobe released version 11.0.02 of its Adobe Reader and Adobe Acrobat Pro applications. Vulnerabilities affect Adobe Reader and Acrobat XI 11.0.01 and earlie...

Patch released for critical Adobe vulnerabilities

Today Adobe released a patch for two critical vulnerabilities CVE-2013-0640 and CVE-2013-0641 that are already being exploited by attackers. Adobe released version 11.0.02 of its Adobe Reader and Adobe Acrobat Pro applications. Vulnerabilities affect Adobe Reader and Acrobat XI 11.0.01 and earlie...

Oracle Patches Critical Java Flaws in 7u15

On a day when Java zero day exploits were fingered in attacks against Apple, Facebook and Twitter, Oracle released the remainder of its quarterly security patch updates for the Java platform. Five vulnerabilities were patched in Java 7 Update 15 today, all of them remotely exploitable, and three ...

Nagios XI 2011R1.9 Multiple SQL Injection Vulnerabilities

The remote host is running Nagios XI 2011R1.9. This version is reportedly affected by multiple SQL injection vulnerabilities in the 'hostgroups.php', 'services.php', 'hosts.php', and 'servicegroups.php' scripts. Note that exploitation requires that an attacker to be authenticated. %NASLMINLEVEL...

ChillyCMS 1.3.0 - Multiple Vulnerabilities

Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities Google Dork: "powered by chillyCMS" Date: 15 February 2013 Exploit Author: Abhi M Balakrishnan Vendor Homepage: http://chillycms.bplaced.net/ Software Link: http://chillycms.bplaced.net/chillyCMS/media/files/chillyCMSfull.zip Version: 1.3.0...

Adobe Recommends Protected View as Temporary Zero Day Mitigation

Adobe released an advisory yesterday suggesting a manual mitigation for zero-day vulnerabilities in its Reader and Acrobat products that are being actively exploited in the wild. The exploit is the first sandbox escape in Adobe Reader X and above. FireEye, which reported the vulnerability to Adob...

Dell SonicWALL Scrutinizer - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/57949/info The Dell SonicWALL Scrutinizer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the...

Distributed Red Team Operations with Cobalt Strike

What if you could easily host malicious websites, send phishing emails, and manage compromised hosts across diverse internet addresses? This week's Cobalt Strike adds the ability to manage multiple attack servers at once. Here's how it works: When you connect to two or more servers, Cobalt Strike...

Mozilla Firefox 18.0.2/Opera 12.12/Internet Explorer 9 Memory Corruption

Exploit for multiple platform in category remote exploits This is private exploit. You can buy it at https://0day.today...

Bots, Zeus, Web Exploits: the Most Potent Threats of 2012

Every year it seems that security-related news advances further from its roots in national security circles, IT departments, and the antivirus industry into the mainstream consciousness. From July to the end of year was no exception. However, despite a handful of flashy security stories, F-Secure...

Predictive Security Analytics Tool Available Free to Researchers

SAN JUAN, Puerto Rico – Dan Hubbard has lately been a regular face at a lot of big data meet-ups. He’s also often been the lone security face at these meet-ups, which are dominated by analytics, search, social media and advertising professionals. That may change soon for the CTO of DNS and securi...

CVE-2013-7387

creationtimestamp| type| source ---|---|--- 2013-01-28 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/24438 2013-02-01 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/24444...

MySQL 5.5 < 5.5.29 Multiple Vulnerabilities

The version of MySQL 5.5 installed on the remote host is earlier than 5.5.29 and is, therefore, affected by vulnerabilities in the following components : - Information Schema - InnoDB - MyISAM - Server - Server Locking - Server Optimizer - Server Parser - Server Partition - Server Privileges -...

Java 7u11 Update Addresses Only One of Two Zero-Day Vulnerabilities

Microsoft can take some solace that it is not alone in sending out security updates that don’t fully address a zero-day vulnerability. A researcher at Immunity Inc., put Oracle on a similar hot seat this week when he reported that a recent out-of-band Java update repaired only one of two Java fla...

RHEL 5 / 6 : java-1.7.0-openjdk (RHSA-2013:0165)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0165 advisory. - OpenJDK: MethodHandles incorrect permission checks Libraries, 8004933 CVE-2012-3174 - OpenJDK: MethodHandles.Lookup incorrect permissi...

Out-of-Band IE Patch Released as More Sites Attacked

Internet Explorer users, exposed to a zero-day vulnerability in the browser and a faulty temporary Fix It from Microsoft, finally got some relief today when the company, as promised, released an out-of-band patch. Meanwhile, a handful of new telco, manufacturing and human rights sites have been...

MS13-008: Security Update for Internet Explorer (2799329)

The remote host is missing Internet Explorer IE Security Update 2799329. The installed version of IE is affected by a vulnerability that could allow an attacker to execute arbitrary code on the remote host. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid63522;...