OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)

It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory...

Pawn Storm – A Look Into this Cyberespionage Actor Group

In April 2017 my monthly threat webinar focused on a cyberespionage group our Forward-Looking Threat Researcher, Feike Hacquebord, has been following for many years and recently published a report into the most recent two years of activities. In this post I want to focus on their tools and tactic...

Blackmoon Banking Trojan Using New Infection Technique

New clues have surfaced on how the Blackmoon banking Trojan is infecting its victims using a new framework to deliver the malware. “We noticed recent campaigns two weeks ago where Blackmoon had shifted its infection strategy and is now utilizing a unique and interesting technique,” said Hardik...

Oracle Sun ZFS Storage Appliance Kit (AK) Remote Elevation of Privilege Vulnerability

The Oracle ZFS Storage Appliance delivers high performance for all applications and integrates with Oracle Public Cloud, making it easy for users and applications to leverage cloud storage. A remote elevation of privilege vulnerability exists in the Oracle Sun ZFS Storage Appliance Kit AK, which...

Oracle Sun ZFS Storage Appliance Kit Unauthorized Operation Vulnerability

Oracle Sun Systems Products Suite is a suite of Sun systems products from Oracle Corporation.Sun ZFS Storage Appliance Kit AK is one of the ZFS storage appliance kits. A security vulnerability exists in the User Interface subsystem subcomponent of the Sun ZFS Storage AK component in Oracle Sun...

Oracle Sun ZFS Storage Appliance Kit Remote Vulnerability (CNVD-2017-06327)

Oracle Sun Systems Products Suite is a suite of Sun systems products from Oracle Corporation.Sun ZFS Storage Appliance Kit AK is one of the ZFS storage appliance kits. A security vulnerability exists in the RAS subsystems subcomponent of the Sun ZFS Storage AK component of the Oracle Sun Systems...

CVE-2017-3621

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: IPC Frameworks. The supported version that is affected is AK 2013. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CVE-2017-3578

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: RAS subsystems. The supported version that is affected is AK 2013. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Sun ZFS...

CVE-2017-3580

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: RAS subsystems. The supported version that is affected is AK 2013. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CVE-2017-3584

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: RAS subsystems. The supported version that is affected is AK 2013. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Sun ZFS...

CVE-2017-3585

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: User Interface subsystem. The supported version that is affected is AK 2013. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2017-3580

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: RAS subsystems. The supported version that is affected is AK 2013. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CVE-2017-3621

Vulnerability in the Sun ZFS Storage Appliance Kit AK component of Oracle Sun Systems Products Suite subcomponent: IPC Frameworks. The supported version that is affected is AK 2013. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CVE-2017-3578

CVE-2017-3578 describes a vulnerability in the Sun ZFS Storage Appliance Kit (AK) within Oracle Sun Systems Products Suite (subcomponent: RAS subsystems). Affected: AK 2013. The issue is exploitable by a low-privileged attacker who can log on to the infrastructure where AK runs, potentially leadi...

CVE-2017-3585

The CVE-2017-3585 entry concerns the Sun ZFS Storage Appliance Kit (AK) within Oracle Sun Systems Products Suite. Affected is AK 2013 in the UI subcomponent. The vulnerability enables an unauthenticated, network-accessible attacker (via HTTP) to perform unauthorized updates, inserts, or deletes o...

CVE-2017-3584

CVE-2017-3584 describes a vulnerability in Oracle Sun ZFS Storage Appliance Kit (AK), subcomponent RAS subsystems, affecting AK version 2013. The issue allows a low-privileged user with local access to compromise the Sun ZFS Storage Appliance Kit (AK), with potential takeover and impact to relate...

Oracle Sun ZFS Storage Appliance Kit (AK) Remote Vulnerability

Oracle Sun ZFS is a Sun system product suite from Oracle Corporation.Sun ZFS Storage Appliance Kit AK is one of the ZFS storage appliance kits. A security vulnerability exists in the IPC Frameworks subcomponent of the Sun ZFS Storage AK component in Oracle Sun Systems Products Suite version 2013...

Lenovo Customer Care Software Development Kit Local Elevation of Privilege Vulnerability

The Lenovo Customer Care Software Development Kit CCSDK is a set of pre-installed software for program maintenance use by the Chinese company Lenovo. A local elevation of privilege vulnerability exists in Lenovo Customer Care Software Development Kit. A local attacker could exploit this...

Terror Exploit Kit

Terror exploit kit, is a web exploit kit that operates by delivering malicious payload to the victim's computer. Remote attackers can infect users with Terror exploit kit by enticing them to visit a malicious web page. Successful infection will allow the attacker to perform Remote Code Execution ...

KaiXin Exploit Kit

KaiXin exploit kit is a web exploit kit that operates by delivering malicious payload to the victim's computer. Remote attackers can infect users with KaiXin exploit kit by enticing them to visit a malicious web page. Successful infection will allow the attacker to perform Remote Code Execution o...