CVE-2015-7809

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

CVE-2015-7809

Removed by vendor...

CVE-2015-7809

CVE-2015-7809 affects the Twig templating engine (Sensio Labs Twig) prior to version 1.20.0. When Sandbox mode is enabled, the displayBlock function in Template.php allows remote code execution via the _self variable in templates. Several connected advisories confirm the issue as a remote code ex...

This Malware Can Delete and Replace Your Entire Chrome Browser with a lookalike

Security researchers have uncovered a new piece of Adware that replaces your entire browser with a dangerous copy of Google Chrome, in a way that you will not notice any difference while browsing. The new adware software, dubbed "eFast Browser," works by installing and running itself in place of...

Netgear Patches Routers Under Attack

After a pair of very public disclosures in the last two weeks, Netgear published new firmware for vulnerabilities in its routers that have been publicly exploited. Researchers discovered as many as 10,000 routers had been taken over, according to data lifted from one of the command and control...

October 2015 Adobe Reader, Acrobat Flash Patches

Adobe today released a jumbo-sized Patch Tuesday update for Reader, Acrobat, and Flash, addressing a combined 69 critical vulnerabilities in the software, many which can lead to information disclosure and code execution. The company warned about the bugs via a blog post at its Product Security...

Canary Labs Trend Web Server Buffer Overflow Vulnerability

Canary Labs Trend Web Server is a data visualization solution from Canary Labs, USA. A buffer overflow vulnerability exists in Canary Labs Trend Web Server 9.0.2.27051 and prior versions. A remote attacker can exploit this vulnerability by sending specially crafted TCP packets to execute arbitrar...

Netgear Router Vulnerabilities Public Exploits

A vulnerability in Netgear routers, already disclosed by two sets of researchers at different security companies, has been publicly exploited. Netgear, meanwhile, has yet to release patched firmware, despite apparently having built one and confirmed with one of the companies that privately...

CVE-2015-5653

Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet...

Buffer overflow

Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet...

CVE-2015-5653

Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet...

CVE-2015-5653

Canary Labs Trend Web Server suffers a buffer overflow (CWE-119) that allows remote code execution via a specially crafted TCP packet. Affected: Trend Web Server before 9.5.2 (and older versions per CNVD/JVN). Root cause: inadequate bounds checking in TCP packet handling. Impact: remote attacker ...

JVN#07676450: Canary Labs Trend Web Server vulnerable to buffer overflow

Trend Web Server provided by Canary Labs is a solution used for data visualization. Trend Web Server contains a buffer overflow CWE-119 vulnerability. Impact A remote attacker may cause a denial-of-service DoS or execute arbitrary code when sending a specially crafted TCP packet. Solution Stop...

Sensio Labs Twig Templates Remote Code Execution Vulnerability

Sensio Labs Twig is a PHP template engine that allows developers to customize tags and filters and create DSLs. A remote input validation vulnerability exists in Sensio Labs Twig, which allows remote attackers to exploit the vulnerability to submit a special request to execute arbitrary code...

XcodeGhost Apple AppStore Malware

As more eyes peer into XcodeGhost, the malware that managed to sneak into Apple’s App Store, more trouble bubbles to the surface. Researchers at Palo Alto Networks said in an updated report that the malware contains a vulnerability that allows an attacker in man-in-the-middle position to control...

DerbyCon is right around the corner (Sept. 23 - 25)

DerbyCon is right around the corner Sept. 23 - 25 and we wanted to highlight two sessions that Coalfire Labs team members will be presenting...

Write a unable to uninstall the App – Device Manager vulnerability-vulnerability warning-the black bar safety net

Two days ago some friends found the phone has an app cannot be uninstalled, after known because the Device Manager to activate the LED, then go try to cancel, but the cancel the the moment the card machine. Repeatedly toss after, only to re-brush. Later he sent an article about the Device Manager...

Apache ActiveMQ 5.0.0 - 5.10.0 JAAS LDAPLoginModule empty password authentication Vulnerability

Exploit for multiple platform in category web applications CVE-2014-3612: ActiveMQ JAAS: LDAPLoginModule allows empty password authentication and Wildcard Interpretation Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache ActiveMQ 5.0.0 - 5.10.0 Description: It wa...

Android System Google Admin app exposed 0day vulnerabilities, can bypass the sandbox-vulnerability warning-the black bar safety net

MWR Labs researchers discovered a 0day vulnerability exists in the Android system of the Google Admin app to handle some URL in the way that, by the vulnerability the attacker can bypass the Android sandbox mechanism. The vulnerability principle For the Google Android security team, this month is...

Android Zero Day in Admin App Can Bypass Sandbox

The Android security team at Google is having a busy month. First the Stagefright vulnerabilities surfaced last month just before Black Hat and now researchers at MWR Labs have released information on an unpatched vulnerability that allows an attacker to bypass the Android sandbox. The...