Default Password 'password' for 'admin1' Account

The account 'admin1' on the remote host has the default password 'password'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "admin1"; password = "password";...

DEBIAN-CVE-2016-8660

The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service fdatasync failure and system hang by using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation."...

PT-2016-7543

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.8.3 Description The issue allows local users to cause a denial of service, resulting in an fdatasync failure and system hang, by utilizing the vfs syscall group in the trinity program. This is related to a page...

StrongPity APT Covets Secrets of Crypto Users

APT groups covet secrets, and one in particular has chosen to target users intent on protecting theirs. The group is known as StrongPity, and it’s been a characteristic APT outfit using its share of zero days and modular attack tools to infiltrate victims and conduct espionage. This summer,...

Pi-Hole Web Interface 2.8.1 - Persistent Cross-Site Scripting in WhitelistBlacklist

Pi-Hole Web Interface 2.8.1 - Persistent Cross-Site Scripting in WhitelistBlacklist Exploit Title: Pi-Hole Web Interface Stored XSS in White/Black list file Author: loneferret from Kioptrix Product: Pi-Hole Version: Web Interface 1.3 Web Interface software: https://github.com/pi-hole/AdminLTE...

Pi-Hole Web Interface 2.8.1 - Persistent Cross-Site Scripting in Whitelist/Blacklist

Exploit Title: Pi-Hole Web Interface Stored XSS in White/Black list file Author: loneferret from Kioptrix Product: Pi-Hole Version: Web Interface 1.3 Web Interface software: https://github.com/pi-hole/AdminLTE Version: Pi-Hole v2.8.1 Discovery date: July 20th 2016 Vendor Site: https://pi-hole.net...

Pi-Hole Web Interface 2.8.1 - Persistent Cross-Site Scripting in Whitelist/Blacklist

Exploit for linux platform in category web applications Exploit Title: Pi-Hole Web Interface Stored XSS in White/Black list file Author: loneferret from Kioptrix Product: Pi-Hole Version: Web Interface 1.3 Web Interface software: https://github.com/pi-hole/AdminLTE Version: Pi-Hole v2.8.1 Discove...

Pi-Hole 2.8.1 Cross Site Scripting

Exploit Title: Pi-Hole Web Interface Stored XSS in White/Black list file Author: loneferret from Kioptrix Product: Pi-Hole Version: Web Interface 1.3 Web Interface software: https://github.com/pi-hole/AdminLTE Version: Pi-Hole v2.8.1 Discovery date: July 20th 2016 Vendor Site: https://pi-hole.net...

Critical Print Spooler Bug allows Attackers to Hack any version of Microsoft Windows

Microsoft's July Patch Tuesday offers 11 security bulletins with six rated critical resolving almost 50 security holes in its software. The company has patched a security flaw in the Windows Print Spooler service that affects all supported versions of Windows ever released, which if exploited cou...

'Dropping Elephant' APT Attackers Targets Old Windows Flaws

Don’t judge an APT by its exploits alone. That’s the takeaway from a report that details a unique advanced persistent threat that leverages a kludge of unsophisticated, outdated and rudimentary attack tools to conduct cyber espionage. The target of the attacks are government and diplomatic agenci...

Adobe Patches Flash Zero Day Under Attack by APT Group

Adobe on Thursday patched a zero-day vulnerability in Flash Player that has been used in targeted attacks carried out by a new APT group operating primarily against high-profile victims in Russia and Asia. Researchers at Kaspersky Lab privately disclosed the flaw to Adobe after exploits against t...

Android Qualcomm Vulnerability Impacts 60 Percent of Devices

A flaw in mobile chip maker Qualcomm’s mobile processor, used in 60 percent of Android devices, allows attackers to take control over a targeted phone or tablet under specific conditions. Researchers at Duo Labs said the vulnerability is tied to Android’s problem-plagued mediaserver, coupled with...

Fast Golang DNS Proxy: grimd

Fast golang dns proxy that can run anywhere, built to black-hole internet advertisements and malware servers Incoming requests spawn a goroutine and are served concurrently, and the block cache resides in-memory to allow for rapid lookups, allowing grimd to serve thousands of queries at once whil...

PT-2016-1943 · Adobe +3 · Flash Player +3

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 21.0.0.226 and earlier Description: The issue allows remote attackers to execute arbitrary code via unspecified vectors. It has been exploited in the wild, specifically in May 2016. The vulnerability is related to...

DEBIAN-CVE-2015-8839

Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service disk corruption by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling...

Race condition

Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service disk corruption by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling...

UBUNTU-CVE-2015-8839

Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service disk corruption by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling...

Slack Plugs Token Security Hole

Popular collaboration and communication firm Slack rushed to plugged a security hole in its platform Thursday that was leaking some of its users’ private chats and files for anyone to access. Slack, a leading tool used by companies to communicate internally, was alerted by security firm Detectify...

Facebook Password Reset Bug Gave Hacker Access To Any Account

Anand Prakash could have hacked your Facebook account or anyone else’s. The India-based security researcher found a glaring password-reset vulnerability last month that has since been patched. The bug allowed him to crack open any of Facebook’s 1.1 billion accounts using a rudimentary brute force...

Proofpoint Warns Of New MSIL/Crimson Tied To Cyber Espionage

Diplomats and military personnel in India have been victimized in targeted espionage attacks that use a number of means of infection including phishing and watering hole sites. Researchers at Proofpoint this week published a report on Operation Transparent Tribe, which was ongoing as of Feb. 11...