Internet Bug Bounty: Adobe Flash Player ShimContentFactory.retrieveResolvers Memory Corruption Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of ShimContentFactory.retrieveResolvers. ------------------------------------------------------------------ II. Description Normally, retrieveResolvers should validates its...

Internet Bug Bounty: Adobe Flash Player ShimContentFactory class Memory Corruption Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of ShimContentFactory.retrieveOpportunityGenerators. ------------------------------------------------------------------ II. Description Normally, retrieveOpportunityGenerators...

Fix Coming for Flash Vulnerability Under Attack

Adobe today said it will patch Flash Player this week, addressing a vulnerability being exploited in “limited, targeted attacks.” The flaw, CVE-2016-4171, exists in versions of Flash prior to, and including, 21.0.0.242 on Windows, Macintosh, Linux and ChromeOS platforms. “Successful exploitation...

Hyperoptic (Tilgin) Router HG23xx Multiple XSS And CSRF Vulnerabilities

Summary Tilgin's HG23xx family of products offers a flexible and high capacity product in a tiny form factor. When having the product in your hands, do not get fooled by its mere size. The product offers full gigabit routing and a state of the art superior WLAN solution. It runs all services...

Updated CryptXXX Ransomware Big Money Potential

CryptXXX ransomware has received a major overhaul by its authors, putting it on the fast track to unseat Locky as top moneymaker for criminals. Researchers at Proofpoint said that on May 26, cybercriminals released an updated CryptXXX 3.100 version of the ransomware that includes a new StillerX...

Arrests Made In $45M Russian Bank Hack

Russian law enforcement has made 50 arrests in connection with a five-year operation to steal three billion rubles just shy of $45 million USD from the country’s largest bank, Sberbank. The hackers are alleged to have exploited websites, including popular news sites, to infect victims with the Lu...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.1 and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-thunderbird-45.1.1-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more...

FlatPress 1.0.3 CSRF Arbitrary File Upload

Summary FlatPress is a blogging engine that saves your posts as simple text files. Forget about SQL! You just need some PHP. Description The vulnerability is caused due to the improper verification of uploaded files via the Uploader script using 'upload' POST parameter which allows of arbitrary...

APT Groups Exploiting Patch Microsoft Office Flaw CVE-2015-2545

A Microsoft Office vulnerability patched six months ago continues to be a valuable tool for APT gangs operating primarily in Southeast Asia and the Far East. Researchers at Kaspersky Lab today published a report describing how attackers continue to flourish exploiting CVE-2015-2545, a remote code...

EduSec 4.2.5 Multiple SQL Injection Vulnerabilities

Summary EduSec has a suite of selective modules specifically tailored to the requirements of education industry. EduSec is engineered and designed considering wide range of management functions within the university. With the use of EduSec, staff can be more accountable as it helps to know the...

Real Estate Portal v4.1 Remote Code Execution and Persistent XSS Vulnerabilities

Summary Real Estate Portal is a software written in PHP, allowing you to launch powerful and professional looking real estate portals with rich functionalities for the private sellers, buyers and real estate agents to list properties for sale or rent, search in the database, show featured ads and...

WordPress Plugin Job Script by Scubez - Remote Code Execution

!C:/Python27/python.exe -u JobScript Remote Code Execution Exploit Vendor: Jobscript Product web page: http://www.jobscript.in Affected version: Unknown Summary: JobScript is inbuilt structured website was developed in PHP and MySQL database. It's a complete job script for those who wants to star...

JobScript Remote Code Execution

!C:/Python27/python.exe -u JobScript Remote Code Execution Exploit Vendor: Jobscript Product web page: http://www.jobscript.in Affected version: Unknown Summary: JobScript is inbuilt structured website was developed in PHP and MySQL database. It's a complete job script for those who wants to star...

Operation Technology ETAP 14.1.0 Local Privilege Escalation

Summary Enterprise Software Solution for Electrical Power Systems. ETAP is the most comprehensive electrical engineering software platform for the design, simulation, operation, and automation of generation, transmission, distribution, and industrial systems. As a fully integrated model-driven...

solutionslab.vzw.com XSS vulnerability

Vulnerable URL: https://solutionslab.vzw.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at 28.06.2017 Latest check for patch:| 28.06.2017 19:48 GMT Vulnerability type:| XSS Vulnerability status:| Publicl...

Internet Bug Bounty: Adobe Flash Player OpportunityGenerator class Memory Corruption Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to memory corruption because of improper validation of OpportunityGenerator.update. ------------------------------------------------------------------ II. Description Adobe Flash is a multimedia and software platform used for...

mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 14.1 and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-thunderbird-45.1.0-i486-1slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more...

Certec EDV atvise SCADA server 2.5.9 Privilege Escalation Vulnerability

Summary atvise scada is based on newest technologies and standards: The visualization in pure web technology as well as a consistent vertical object orientation based on OPC UA changes the world of process management systems. Description The application suffers from an unquoted search path issue...

Skype Manager - (Email Change) Filter Bypass Vulnerability

Document Title: =============== Skype Manager - Email Change Filter Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1672 MSRC Case 32353 TRK:0001002845 Release Date: ============= 2016-05-08 Vulnerability Laboratory ID VL-ID:...

ZeewaysCMS Multiple Vulnerabilities

Summary ZeewaysCMS is a Content Management System and a complete Web & Mobile Solution developed by Zeeways for Corporates, Individuals or any kind of Business needs. Description ZeewaysCMS suffers from a file inclusion vulnerability LFI when encoded input passed thru the 'targeturl' GET paramete...