eBay Vulnerability Opens Users Up to Phishing, Data Theft

Researchers are warning that some visitors to eBay.com could be tricked into opening a page on the site that could expose them to phishing attacks and data theft. The vulnerability exists in the site’s online sales platform, according to Roman Zaikin, a researcher with Check Point. With it, an...

FreeBSD -- Linux compatibility layer issetugid(2) system call

Problem Description: A programming error in the Linux compatibility layer could cause the issetugid2 system call to return incorrect information. Impact: If an application relies on output of the issetugid2 system call and that information is incorrect, this could lead to a privilege escalation...

server: build config to a strategy that isn't allowed by policy

An authorization flaw was discovered in Kubernetes; the API server did not properly check user permissions when handling certain build-configuration strategies. A remote attacker could create build configurations with strategies that violate policy. Although the attacker could not launch the buil...

glibc catopen() Unbounded Stack Allocations

glibc catopen Multiple unbounded stack allocations URL: https://cxsecurity.com/issue/WLB-2016010149 --------------------------------------- PoC: include include include int main char buff; buff=malloc11111111; memsetbuff,'A',11111110; buff11111110='\0'; catopenbuff, NLCATLOCALE; return 0;...

Unspecified Vulnerability in Oracle Database XML Developer's Kit for C Component

Oracle Database is a large database of commercial nature. An unspecified security vulnerability exists in the Oracle Database XML Developer's Kit for C component, which could be exploited by remote attackers to conduct denial-of-service attacks...

Oracle Java SE Multiple Vulnerabilities (January 2016 CPU) (SLOTH)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 8 Update 71, 7 Update 95, or 6 Update 111. It is, therefore, affected by security vulnerabilities in the following components : - 2D - AWT - JAXP - JMX - Libraries - Networking - Security...

xWPE 1.5.30a-2.1 - Local Buffer Overflow

Exploit Author: Juan Sacco - http://www.exploitpack.com Program: xwpe - Windows Editor v1.5.30a-2.1 Description: Programming environment and editor for console and X11 Tested and developed on: Kali Linux 2.0 x86 - https://www.kali.org Description: xwpe v1.5.30a-2.1 and prior is prone to a...

xWPE 1.5.30a-2.1 - Local Buffer Overflow

Exploit for linux platform in category local exploits Program: xwpe - Windows Editor v1.5.30a-2.1 Description: Programming environment and editor for console and X11 Tested and developed on: Kali Linux 2.0 x86 - https://www.kali.org Description: xwpe v1.5.30a-2.1 and prior is prone to a stack-bas...

[SECURITY] Fedora 23 Update: golang-1.5.3-1.fc23

The Go Programming Language...

Next Hacker to Organize Biggest Java Programming Competition In Germany

Great news for Hackers and Bug-hunters who enjoy Programming and playing around with Software. A worldwide group of like-minded computer programmers is hosting The Next Hacker IPPC event on the 26th and 27th of February in Berlin, Germany, where participants can meet hackers and programmers from...

FreeBSD -- Linux compatibility layer setgroups(2) system call

Problem Description: A programming error in the Linux compatibility layer setgroups2 system call can lead to an unexpected results, such as overwriting random kernel memory contents. Impact: It is possible for a local attacker to overwrite portions of kernel memory, which may result in a privileg...

[SECURITY] Fedora 22 Update: ruby-2.2.4-47.fc22

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

IBM Maximo Asset Management Information Disclosure Vulnerability

IBM Maximo Asset Management is a suite of IT asset management solutions from IBM USA. An information disclosure vulnerability exists in IBM Maximo Asset Management. It allows remote authenticated users to access sensitive information via a REST API...

Linux/x86-64 - Bindshell 4444/TCP with Password Prompt Shellcode (162 bytes)

/--------------------------------------------------------------------------------------------------------------------- / Title: tcp bindshell with password prompt in 162 bytes Author: Sathish kumar Contact: https://www.linkedin.com/in/sathish94 Description: x64 Linux bind TCP port shellcode on po...

A step-by-step learn the ROP of the Android ARM 3 2-vulnerability warning-the black bar safety net

ROP stands for Return-oriented programming return-oriented programming this is an advanced memory attack techniques that can be used to bypass the modernoperating systema variety of common defenses such as the memory is not performed and code signing. Before we mainly discussed on linux in this...

Cisco Hosted Collaboration Mediation Fulfillment SOAP API Sensitive Information Disclosure Vulnerability

A vulnerability in the Simple Object Access Protocol SOAP application programming interface API of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an authenticated, remote attacker to obtain sensitive information that should be restricted. The attacker must authentica...

Microsoft Windows PGM UAF Elevation of Privilege Vulnerability

Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in the Microsoft Windows Programming Generic Multicast PGM protocol. A local attacker could exploit the vulnerability to execute code using elevated...

0d1n - Tool For Automating Customized Attacks Against Web Applications

Web security tool to make fuzzing at HTTP inputs, made in C with libCurl. You can do: brute force passwords in auth forms directory disclosure use PATH list to brute, and find HTTP status code test list on input to find SQL Injection and XSS vulnerabilities To run: require libcurl-dev or...

applican vulnerable to script injection

Overview applican provided by Newphoria Corporation Inc. is a platform to build hybrid applications for both iOS and Android. applican is vulnerable to script injection due to an issue in proccessing URL. Note that this vulnerability is different from JVN71088919. Kenta Suefusa and Tomonori Shiom...

Vulnerability of the Java Platform software platform, allowing attackers to modify data

The vulnerability of the Security sub-component in JRockit and Java Platform software platforms is related to errors in the code. Exploiting this vulnerability allows a malicious actor to modify data using specially crafted data for the API function...