Adobe issues Emergency Flash Player update to patch critical zero-day threat

Adobe is recommending that users update their Flash Players immediately. The company has published an emergency security bulletin today, that addresses vulnerabilities the Flash Player and released a patch to fix a vulnerability which is currently being exploited in a sophisticated cyber espionag...

Emergency Adobe Flash Player Security Update Patches 0Day

Adobe today released an out-of-band security update for Flash Player that patches a vulnerability the company said is currently being exploited. Adobe Flash Player version 12.0.0.43 and earlier for Windows and Mac are affected as is 11.2.202.335 and earlier on Linux. The vulnerability,...

Apache Tomcat Manager Code Execution Exploit

This Metasploit module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets var...

GameOver Zeus Now Using Encryption to Bypass Detection

Cybercriminals have begun to tweak the way the GameOver Zeus Trojan is being delivered to users’ machines, making it easier for the banking malware to evade detection and steal victims’ credentials. To get the job done the malware has been working in tandem with the malware Upatre. For about a we...

Multiple Vulnerabilities in Eventum

Advisory ID: HTB23198 Product: Eventum Vendor: Eventum Development Team Vulnerable Versions: 2.3.4 and probably prior Tested Version: 2.3.4 Advisory Publication: January 22, 2014 without technical details Vendor Notification: January 22, 2014 Vendor Patch: January 24, 2014 Public Disclosure:...

HackInTheBox Quartal Magazine - eZine Issue 10

Document Title: =============== HackInTheBox Quartal Magazine - eZine Issue 10 References: =========== Download: http://www.vulnerability-lab.com/resources/documents/hitbez10.pdf Original: http://magazine.hackinthebox.org/issues/HITB-Ezine-Issue-010.pdf Release Date: ============= 2014-01-31...

NCH Software Inventoria 3.45 (id param) Reflected Cross-Site Scripting Vulnerability

Summary Inventoria is a business inventory management and stock control software that allows you to manage and monitor your inventory to help streamline your operations and boost profits. Description The application suffers from a reflected XSS issue due to a failure to properly sanitize...

mozilla-nss

New mozilla-nss packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/mozilla-nss-3.15.4-i486-1slack14.1.txz: Upgraded. Upgraded to nss-3.15.4 and nspr-4.10.3. Fixes a possible...

Mozilla Thunderbird vulnerability allows hackers to Insert malicious code into Emails

Do you use Thunderbird, a free; open-source; cross-platform application for managing email and news feeds? According to a Pakistani Security Researcher from Vulnerability-Lab, a flaw gives an attacker the ability to run code on a user’s machine. Mozilla Thunderbird 17.0.6 email application is...

Mozilla Thunderbird does not adequately restrict HTML elements in email message content

Overview Mozilla Thunderbird does not adequately restrict HTML elements in email content, which could allow an attacker to execute arbitrary script when a specially-crafted email message is forwarded or replied to. Description Vulnerability Lab has reported a vulnerability in the way Mozilla...

Mozilla Thunderbird - WireTap Remote 0Day Vulnerability

Document Title: =============== Mozilla Thunderbird - WireTap Remote 0Day Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1182 View: http://www.youtube.com/watch?v=mqZ4eY2th0s Advisory: http://www.vulnerability-lab.com/getcontent.php?id=967 Release Date:...

NCH Software Express Burn Plus 4.68 (.EBP) Project File Buffer Overflow

Exploit for windows platform in category dos / poc !/usr/local/bin/perl NCH Software Express Burn Plus 4.68 EBP Project File Handling Buffer Overflow PoC Vendor: NCH Software Product web page: http://www.nchsoftware.com Affected version: 4.68 Summary: Express Burn is a program that allows you to...

Joomla Komento 1.7.2 Cross Site Scripting Vulnerability

Joomla Komento extension version 1.7.2 suffers from a cross site scripting vulnerability. Product: Komento Joomla Extension Vendor: Stack Ideas Sdn Bhd. Vulnerable Versions: 1.7.2 and probably prior Tested Version: 1.7.2 Advisory Publication: January 2, 2014 without technical details Vendor...

NCH Software Express Burn Plus 4.68 - '.EBP' Project File Buffer Overflow

!/usr/local/bin/perl NCH Software Express Burn Plus 4.68 EBP Project File Handling Buffer Overflow PoC Vendor: NCH Software Product web page: http://www.nchsoftware.com Affected version: 4.68 Summary: Express Burn is a program that allows you to create and copy many kinds of disc media, including...

NCH Software Express Burn Plus 4.68 Buffer Overflow

NCH Software Express Burn Plus version 4.68 suffers from an EBP project file handling buffer overflow vulnerability. !/usr/local/bin/perl NCH Software Express Burn Plus 4.68 EBP Project File Handling Buffer Overflow PoC Vendor: NCH Software Product web page: http://www.nchsoftware.com Affected...

NCH Software Express Burn Plus 4.68缓冲区溢出漏洞

NCH Software是适用于Windows和Mac OS X的音频，视频，听写，商业和计算机实用软件的厂商。 该漏洞是由于项目文件处理时的边界错误引起的，当用户打开例如特制的.EBP文件时，导致一个unicode缓冲区溢出。成功利用此漏洞可能允许执行任意代码。 0 NCH Software Express Burn Plus 4.68 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.nchsoftware.com/ use Cwd; use LWP::Simple; print "\n...

NCH Software Express Burn Plus 4.68 EBP Project File Handling Buffer Overflow PoC

Summary Express Burn is a program that allows you to create and copy many kinds of disc media, including Audio audio CDs / .mp3 CDs, Video DVDs, and Data CDs / DVDs / Blu-ray. Description The vulnerability is caused due to a boundary error in the processing of a project file, which can be exploit...

SQL Injection in doorGets CMS

High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in doorGets CMS: CVE-2014-1459 The vulnerability exists due to insufficient validation of "positiondownid" HTTP POST parameter passed to...

Icefog Cyberespionage Campaign Hit 3 US Oil, Gas Companies

When the curtain was peeled back on the Icefog targeted espionage campaign in September, a new type of operator was unveiled, one that took the persistence out of advanced persistent threats APT. Researchers at Kaspersky Lab noted in uncovering Icefog that the attacks against the defense supply...

Facebook Bug Bounty - Redirect Web Vulnerabilities

Document Title: =============== Facebook Bug Bounty - Redirect Web Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1180 View Video1: http://www.youtube.com/watch?v=xBQYb5MUkk View Video2: http://www.youtube.com/watch?v=3P10Kd8m9bY View Video3:...