Gap Widens Between Attackers, BIOS Forensics, Research

Vendors have made important strides in locking down operating systems, patching memory-related vulnerabilities and other bugs that could lead to remote code execution or give hackers a stealthy presence on a machine. As the hurdles get higher for the bad guys, the better ones will certainly look...

Browser Bugs, BIOS and Brokers dominate CanSecWest, Pwn2Own

Browsers, brokers and BIOS: you could safely call that triumvirate the past, present and future of security, but you’d be wrong. If last week’s CanSecWest conference, and Pwn2Own and Pwnium contests are indeed a point-in-time snapshot of the technical side of information security, then after last...

kernel: xen: hypercalls exposed to privilege rings 1 and 2 of HVM guests

Xen 3.0.3 through 4.1.x possibly 4.1.6.1, 4.2.x possibly 4.2.3, and 4.3.x possibly 4.3.1 does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2...

Fedora 19 : kernel-3.13.5-101.fc19 (2014-2887)

The 3.13.5 rebase contains support for additional hardware, some new features and a number of important bug fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

[SECURITY] Fedora 19 Update: chrony-1.29.1-1.fc19

A client/server for the Network Time Protocol, this program keeps your computer's clock accurate. It was specially designed to support systems with intermittent internet connections, but it also works well in permanently connected environments. It can use also hardware reference clocks, system...

D-LINK DIR-615 Cross Site Request Forgery

Exploit Title: Dlink DIR-615 Hardware Version E4 Firmware Verion 5.10 CSRF Vulnerability Google Dork: N/A Date: 19/02/2014 Exploit Author: Dhruv Shah Vendor Homepage: http://www.dlink.com/us/en/home-solutions/connect/routers/dir-615-wireless-n-300-router Software Link: N/A Hardware Version:E4...

Dlink DIR-615 Hardware vE4 Firmware v5.10 - CSRF Vulnerability

Exploit for hardware platform in category web applications Cross Site Request Forgery This Modem's Web Application , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url. The Modems's Application not using any security token t...

Fedora 20 : kernel-3.13.3-201.fc20 (2014-2576)

The 3.13.3 stable update contains a number of important fixes across the tree. The 3.13.2 rebase contains support for additional hardware, some new features and a number of important bug fixes across the tree. Fixes CVE-2014-0069 cifs: incorrect handling of bogus user pointers Note that Tenable...

D-Link DSL-2750B ADSL Router跨站请求伪造漏洞

No description provided by source. Exploit Title : D-Link DSL-2750B ADSL Router CSRF Vulnerability Date : 10-02-2014 Author : [email protected] Vendor site : http://www.d-link.com Version : DSL-2750B Tested on : Firmware Version: EU2.02; Hardware Version: B1 The D-Link DSL-2750B's web interface...

D-Link DSL-2750B ADSL Router - CSRF Vulnerability

Exploit for hardware platform in category web applications Exploit Title : D-Link DSL-2750B ADSL Router CSRF Vulnerability Date : 10-02-2014 Author : email protected Vendor site : http://www.d-link.com Version : DSL-2750B Tested on : Firmware Version: EU2.02; Hardware Version: B1 The D-Link...

D-Link DSL-2750B ADSL Route' - Cross-Site Request Forgery

Exploit Title : D-Link DSL-2750B ADSL Router CSRF Vulnerability Date : 10-02-2014 Author : [email protected] Vendor site : http://www.d-link.com Version : DSL-2750B Tested on : Firmware Version: EU2.02; Hardware Version: B1 The D-Link DSL-2750B's web interface listening on tcp/ip port 80 is pron...

D-Link DSL-2750B ADSL Route - Cross-Site Request Forgery

D-Link DSL-2750B ADSL Route - Cross-Site Request Forgery Exploit Title : D-Link DSL-2750B ADSL Router CSRF Vulnerability Date : 10-02-2014 Author : [email protected] Vendor site : http://www.d-link.com Version : DSL-2750B Tested on : Firmware Version: EU2.02; Hardware Version: B1 The D-Link...

[SECURITY] Fedora 20 Update: chrony-1.29.1-1.fc20

A client/server for the Network Time Protocol, this program keeps your computer's clock accurate. It was specially designed to support systems with intermittent internet connections, but it also works well in permanently connected environments. It can use also hardware reference clocks, system...

A10 Networks AX Loadbalancer Directory Traversal

This module exploits a directory traversal flaw found in A10 Networks Soft AX Loadbalancer version 2.6.1-GR1-P5/2.7.0 or less. When handling a file download request, the xml/downloads class fails to properly check the 'filename' parameter, which can be abused to read any file outside the virtual...

CVE-2013-5987

Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 allows local users to bypass intended access restrictions for the GPU and gain privileges via unknown vectors...

Feixun Wireless Router FWR-604H - Remote Code Execution Exploit

Exploit for hardware platform in category web applications Exploit Title: Feixun FWR-604H Wireless Router Remote Code Execution Date: 2014-01-09 Exploit Author: Arash Abedian Vendor Homepage: http://feixun.com.cn Version: Hardware Version 1.0, Firmware Build: 7642 Tested on: Hardware Version 1.0,...

Firmware vulnerability allows man-in-the-middle attack using SD Memory cards

How is it possible to exploit SD Card, USB stick and other mobile devices for hacking? Another interesting hack was presented at the Chaos Computer Congress 30C3, in Hamburg, Germany. The researchers demonstrated how it is possible to hack the microcontroller inside every SD and MicroSD flash car...

MicroSD Cards Vulnerable to MITM, Hacking

Researchers demonstrated yesterday at the Chaos Communication Congress in Hamburg that they could write arbitrary code onto various SD memory cards, a hack that could give attackers the ability to perform man-in-the-middle attacks on devices housing the cards, as well as give users access to an...

Jacob Appelbaum 2013 30c3 keynote on NSA Surveillance

Cryptographer, developer and activist Jacob Appelbaum took to the pages of Germany’s Der Spiegel and the keynote dais of the 30th Chaos Communication Congress this weekend to deliver a damning expose of the catalog of backdoors, monitoring programs and products that potentially have and could be...

Null pointer dereference

Xen in the Linux kernel, when running a guest on a host without hardware assisted paging HAP, allows guest users to cause a denial of service invalid pointer dereference and hypervisor crash via the SAHF instruction...