MyServer 0.4.3 DoS

No description provided by source. / MyServer 0.4.3 DoS vendor: http://myserverweb.sourceforge.net Written and found by badpack3t at security-protocols.com For SP Research Labs 09/08/2003 usage: sp-myserv targetip targetport default is 80 / include stdafx.h include winsock2.h include stdio.h prag...

SSL Pulse Scans Quantify Vulnerable OpenSSL Servers

Certain mitigating factors made the recent OpenSSL man-in-the-middle vulnerability a notch or two below Heartbleed in terms of criticality. With that in consideration, it’s probably no surprise that patching levels for CVE-2014-0224 aren’t as high out of the gate as they were for Heartbleed. Ivan...

Debian Security Advisory DSA 2936-1 (torque - security update)

John Fitzpatrick from MWR Labs reported a stack-based buffer overflow vulnerability in torque, a PBS-derived batch processing queueing system. An unauthenticated remote attacker could exploit this flaw to execute arbitrary code with root privileges. OpenVAS Vulnerability Test $Id: deb2936.nasl 67...

Kolibri Web Server 2.0 - GET Stack Buffer Overflow

!/usr/bin/python Exploit Title: Kolibri GET request Stack buffer Overflow Date: 25 April 2014 Exploit Author: Christian Polunchis Ramirez https://intrusionlabs.org Vendor Homepage: http://www.senkas.com/kolibri/download.php Version: Kolibri 2.0 Tested on: Windows XP SP3, Spanish Thanks:To my wife...

WordPress 3.8.2 patch analysis HMAC timing attack-vulnerability warning-the black bar safety net

author: [email protected] 0x00 background On github over and over to see for a long time, the official version of the diff only in php where changes to a location: | 1 2 | - if $hmac != $hash + if hashhmac 'md5', $hmac, $key !== hashhmac 'md5', $hash, $key ---|--- WP developers just...

VMSA-2014-0003:VMware vSphere Client updates address security vulnerabilities

VMSA-2014-0003 VMware vSphere Client updates address security vulnerabilities VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2014-0003 VMware Security Advisory Synopsis: VMware vSphere Client updates address security vulnerabilities VMware Security Advisory Issue date:...

Threatglass Tool Gives Deep Look Inside Compromised Sites

Trying to enumerate the compromised sites on the Internet is a Sisyphian task. Luckily, it’s not a task that anyone really needs to perform any longer, especially now that Barracuda Labs has released its new Threatglass tool, a Web-based frontend that allows users to query a massive database of...

Netvolution WCM CMS 3 SQL Injection

Exploit Title: Netvolution WCM - CMS v3 SQL Injection Exploit Type: Error-based SQL injection Date: Sun 02 Mar 2014 Exploit Author: projectzero labs Projectzero ID: projectzero2014-002-netvolutionsqli Vendor Homepage: http://www.netvolution.net && http://www.atcom.gr Version: 3 as vendor comfirme...

Byte CMS Cross Site Scripting

Exploit Title: Byte CMS Cross Site Scripting Vulnerabilities Date: 02/03/2014 Exploit Author: projectzero labs Projectzero ID: projectzero2014-003-bytecmsxss Vendor Homepage: http://www.bitsnbytes.gr Software Link: N/A - Commercial Tested on: Kali Linux / Iceweasel v.22 & Mac OS X 10.8.5 / Firefo...

[SECURITY] CVE-2013-4322 Incomplete fix for CVE-2012-3544 (Denial of Service)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2013-4322 Incomplete fix for CVE-2012-3544 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.0-RC5 - - Apache Tomcat 7.0.0 to 7.0.47 - - Apache Tomcat 6.0.0 to 6.0.37...

Complete Microsoft EMET Bypass Developed

SAN FRANCISCO — Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft’s Enhanced Mitigation Experience Toolkit EMET. Principal security researcher Jared DeMott is scheduled to deliver a presentation this morning...

Update Adobe Shockwave Player to fix Critical Remote Code Execution Vulnerabilities

Adobe has released a security update to address critical vulnerabilities for Adobe Shockwave Player 12.0.7.148 and earlier versions of the Windows and Mac OS X systems. The Patch fixes two critical remote code execution vulnerabilities, that could potentially allow an attacker to remotely take...

Adobe Patches Shockwave, Fixes Two Vulnerabilities

Adobe joined Microsoft in releasing security patches today, sending out a fix for its Shockwave Player. The patch repairs critical vulnerabilities in the platform that could allow an attacker to remotely takeover an affected system. According to a post on its Product Security Incident Response Te...

The Mask Malware: A 7-Year Cyber Espionage Campaign Unmasked

A sophisticated cyber spying operation, The Mask , that has been under the radar for about 7 years and targeted approximately 31 countries, has now been unmasked by researchers at Kaspersky Labs. Researchers believe the campaign has been active since 2007 and is a highly sophisticated nation-stat...

Extension Spam in Google Chrome Web Store

UPDATE: Twelve seemingly legitimate Chrome browser extensions installed by more than 180,000 users are injecting advertisements on 44 popular websites. According to a Barracuda Labs report, the extensions can be found in the official Chrome Web Store. They advertise themselves and operate as game...

SoapUI 4.6.3 - Remote Code Execution Vulnerability

Exploit for windows platform in category remote exploits Exploit Title: SoapUI Remote Code Execution Date: 25.12.13 Exploit Author: Barak Tawily Vendor Homepage: http://www.soapui.org/ Software Link: http://www.soapui.org/Downloads/download-soapui-pro-trial.html Version: vulnerable before 4.6.4...

CMS Afroditi 1.0 Blind SQL Injection

Exploit Title: CMS Afroditi v.1.0 Blind SQL Injection Date: 30/12/2013 Exploit Author: projectzero labs Vendor Homepage: http://www.naxtech.com Vendor Informed: 20 & 24/12/2013 Software Demo: http://afroditi.naxtech.com Version: v.1.0 About the software: =================== Αs indicated in the...

Codiad 2.0.7 Cross Site Scripting

Exploit Title: Codiad - Stored Persistent Cross Site Scripting Vulnerability Date: 02/12/2013 Exploit Author: Project Zero Labs Vendor Homepage: http://www.codiad.com Software Link: https://github.com/Codiad/Codiad Version: v.2.0.7 Tested on: Kali Linux / Iceweasel v.22 About the software:...

Growing market of zero-day vulnerability exploits pose real threat to Cyber Security

NSS Labs issued the report titled "The Known Unknowns" to explain the dynamics behind the market of zero-day exploits. Last week I discussed about the necessity to define a model for "cyber conflict" to qualify the principal issues related to the use of cyber tools and cyber weapons in an...

Debian DSA-2796-1 : torque - arbitrary code execution

Matt Ezell from Oak Ridge National Labs reported a vulnerability in torque, a PBS-derived batch processing queueing system. A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these comman...