CVE-2014-1780

The connected document provides concrete details for Internet Explorer memory corruption stemming from a use-after-free in IE 10/11 related to CVE-2014-1772 (not exactly CVE-2014-1780, but in the same family). It explains how memory corruption can be triggered by a crafted web page, enabling remo...

CVE-2014-1774

Affected software: Microsoft Internet Explorer 9. The vulnerability is a memory corruption flaw in IE9 that can be triggered by a crafted web site, enabling remote code execution or a denial of service. This CVE is part of a set (CVE-2014-1774, -1788, -2754) describing memory corruption vulnerabi...

CVE-2014-1777

CVE-2014-1777 affects Microsoft Internet Explorer 10 and 11. It enables remote attackers to read local files via a crafted webpage (information disclosure). Public exploits exist. Remediation is to install the June 2014 IE security update (MS14-035; KB2969262 or KB2963950, as applicable), per ven...

Microsoft Internet Explorer CVE-2014-2768 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Internet explorer ...

Microsoft Internet Explorer CVE-2014-1795 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Internet Explorer ...

Threatpost News Wrap, May 23, 2014

Dennis Fisher and Mike Mimoso discuss the US indictments of Chinese army officers for hacking, the Blackshades malware arrests, the new IE 8 zero day and the US prospects in the World Cup. Download: digitalunderground154.mp3 Music by Chris Gonsalves...

destoon某敏感功能xss指哪打哪(绕过过滤)

简要描述： 依旧是没处理好富文本，dsafe函数又被绕过了，给出各种浏览器payload（FF和IE1789均直接触发，其他浏览器点击触发）。。。之前学了一招“危害放大”，这回试试看 详细说明： 不多说了，触发点在短消息的位置，所以可以指哪打哪。在http://wooyun.org/bugs/wooyun-2014-054857 里面能找到之前的一个漏洞。dsafe是过滤XSS的函数，之前这个漏洞交了以后destoon官方很负责地对dsafe进行了修改。 但依旧没抓住重点，再次被绕过了。触发方式与上一篇相同。 先看看是怎么绕过的吧。dsafe函数代码如下：...

Adobe Flash Player - Shader Buffer Overflow (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Adobe Flash Player Shader Buffer Overflow", 'Description' = %q This module exploits a buffer overflow vulnerability in Adobe Flash...

May 2014 Microsoft Patch Tuesday Security Updates

One week after releasing an out-of-band patch for an Internet Explorer zero day, Microsoft has provided a head’s up that next week’s Patch Tuesday security updates will include another critical patch for the browser. The IE roll-up is one of two critical bulletins expected next week; interestingl...

Protection strategies for the Security Advisory 2963983 IE 0day

We’ve received a number of customer inquiries about the workaround steps documented in Security Advisory 2963983 published on Saturday evening. We hope this blog post answers those questions. Steps you can take to stay safe The security advisory lists several options customers can take to stay...

Adobe Flash Player Type Confusion Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Adobe Flash Player Type Confusion Remote Code Execution", 'Description' = %q This module exploits a type confusion vulnerability foun...

Adobe Flash Player Shader Buffer Overflow

This module exploits a buffer overflow vulnerability in Adobe Flash Player. The vulnerability occurs in the flash.Display.Shader class, when setting specially crafted data as its bytecode, as exploited in the wild in April 2014. This module has been tested successfully on the following operating...

Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free

This module exploits a use after free vulnerability in Adobe Flash Player. The vulnerability occurs in the ByteArray::UncompressViaZlibVariant method, when trying to uncompress a malformed byte stream. This module has been tested successfully on: Windows 7 SP1 32 bits, IE 8 to IE 11 and Flash...

StopTheHacker: XSS Reflected - https://www.stopthehacker.com/

Hi. I want to report a Reflected xss vulnerability that I found in www.stopthehacker website and which can affect the safety of your users. This vulnerability allows an attacker to inject in web pages javascript content for sending malicious scripts to an unsuspecting user. This flaw can access a...

Microsoft Internet Explorer 10 - CMarkup Use-After-Free (MS14-012)

Microsoft Internet Explorer 10 - CMarkup Use-After-Free MS14-012 mxmlc.exe AsXploit.as -o AsXploit.swf Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/32851-AsXploit.as -- var garr = ; var arrLen = 0x250; function dword2datadword var d =...

Adobe Flash Player domainMemory ByteArray Use After Free

This module exploits a use-after-free vulnerability in Adobe Flash Player. The vulnerability occurs when the ByteArray assigned to the current ApplicationDomain is freed from an ActionScript worker, when forcing a reallocation by copying more contents than the original capacity, but Flash forgets...

CVE-2014-1760

CVE-2014-1760 concerns multiple memory-corruption vulnerabilities in Microsoft Internet Explorer 11. Reported as a remote-code-execution/denial-of-service class when visiting a crafted web site, with the root cause tied to memory handling in IE’s rendering/parsing paths (e.g., ZDI cites CFormatCa...

CVE-2014-1751

CVE-2014-1751 is a memory-corruption vulnerability in Microsoft Internet Explorer (IE) that can be triggered by visiting a crafted web site, enabling remote code execution or memory corruption leading to a denial of service. The IE family (versions 6–11) is affected; the underlying issue is a mem...

IE 12 to Support HSTS Encryption Protocol

Microsoft confirmed today it will support HTTPS Strict Transport Protocol HSTS in Internet Explorer 12, bringing its browser in line with other major vendors in its support of the protocol. Browsers supporting HSTS force any sessions sent over HTTP to be sent instead over HTTPS, encrypting...

destoon最新版某敏感功能xss指哪打哪

简要描述： 之前提交过，官方说补了 http://www.wooyun.org/bugs/wooyun-2014-053573 于是我看看修补以后的效果。 详细说明： 这是最新版的过滤富文本xss的函数： 已经解决了之前的问题。用expressi0n替换了expression。看似似乎没问题了。 其实还有各种问题。IE还有一个容错特性，那就是expression，其中加斜杠\，在IE6789上是可以触发的（当然我没测试更高版本）。所以，利用这个特性，可以绕过dsafe函数的过滤。 这时候，我们测试： 照弹无误：...