Under the Hoodie: Actionable Research from Penetration Testing Engagements

Today, we're excited to release Rapid7's latest research paper, Under the Hoodie: Actionable Research from Penetration Testing Engagements, by Bob Rudis, Andrew Whitaker, Tod Beardsley, with loads of input and help from the entire Rapid7 pentesting team. This paper covers the often occult art of...

PT-2017-04: Security Restrictions Bypass in Kaspersky Embedded Systems Security

The specialists of the Positive Research center have detected a Security Restrictions Bypass vulnerability in Kaspersky Embedded Systems Security. Vulnerability in the Application Control component of Kaspersky Embedded Systems Security allows attackers to gain privileges and execute arbitrary...

Newly Discovered Mac Malware with Ancient Code Spying on Biotech Firms

Security researchers have discovered a rare piece of Mac-based espionage malware that relies on outdated coding practices but has been used in some previous real-world attacks to spy on biomedical research center computers. Dubbed Fruitfly, the malware has remained undetected for years on macOS...

Oracle Patches 270 Vulnerabilities With First CPU of 2017

Oracle patched 270 vulnerabilities on Tuesday, many remotely exploitable, across 45 different products–including its E-Business Suite, Financial Services software, and MySQL database–as part of its quarterly Critical Patch Update CPU. The massive update comes close breaking Oracle’s record-settin...

ijsrp.org XSS vulnerability

Vulnerable URL: http://www.ijsrp.org/research-paper-0814.php?rp=P323049' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 100568 VIP website status:| No Check ijsrp.org SSL...

Marie Moe on Medical Device Security

Marie Moe, a research scientist at SINTEF of Norway, talks to Mike Mimoso about her personal and emotional connection to medical device security given that she has a pacemaker implanted in her that regulates her heart. Moe, who is in her 30s, has been active in spurring research into the security...

fsuarchon.fcla.edu XSS vulnerability

Vulnerable URL: http://fsuarchon.fcla.edu/?p=collections/research=email=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculat...

Nextcloud: Review remote code execution in SwiftMailer

See https://github.com/swiftmailer/swiftmailer/issues/844 for details, research is on-going and this issue will be added more details later...

maskanha.com XSS vulnerability

Vulnerable URL:...

juneau.lib.ak.us XSS vulnerability

Open Bug Bounty ID: OBB-200184 Description| Value ---|--- Affected Website:| juneau.lib.ak.us Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Wassenaar Renegotiation Will Be in Trump Administration's Hands

A nearly two-year effort to renegotiate language related to export controls around intrusion software in the Wassenaar Arrangement was rejected earlier this month during the member states’ plenary meeting. This means that the overly broad language in the first draft of the rules, introduced in Ma...

CVE-2016-8610: to cause a denial of service“SSL-Death Alert”vulnerability patch analysis-vulnerability warning-the black bar safety net

Recently, one for OpenSSL Red AlertSSL Death Alertvulnerability security patch caught our attention. Other serious security vulnerabilities, this vulnerability also caught our attention, because according to the vulnerability discoverer said, there is this vulnerability of OpenSSL Web servermay b...

lechateau.com XSS vulnerability

Vulnerable URL: http://www.lechateau.com/style/linkshare/index.jsp?siteID=OOTtr9mlaCk-qQ5di8GsBCXSobbgEvxLHQ=https://www.openbugbounty.org'; alert'OPENBUGBOUNTY'; //=333=enCA=true Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 13:20 GMT...

Through static analysis and detection binary code in Use-After-Free vulnerability-vulnerability warning-the black bar safety net

Use-After-Free is a well-known vulnerability types, is often a modern attack code The use of referring to Pwn2own 2016 on. In the research project AnaStaSec, AMOSSYS provides a lot of information about how the static detection binary code of such vulnerability. In this blog, we will send the read...

Orthanc DICOM Server 1.1.0 Unquoted Service Path Privilege Escalation

Orthanc DICOM Server 1.1.0 Unquoted Service Path Privilege Escalation Vendor: SAcbastien Jodogne Product web page: http://www.orthanc-server.com Affected version: 1.1.0 Summary: Orthanc is a Belgian, open-source, lightweight RESTful DICOM server for healthcare and medical research with an...

Microsoft Patches Publicly Disclosed IE, Edge Vulnerabilities

Microsoft today patched a half-dozen critical browser vulnerabilities that have been publicly disclosed, but apparently not used in attacks as of yet. The critical Internet Explorer and Microsoft Edge bulletins are among six released today, along with six others with a severity rating of importan...

Three roads lead to Rome-vulnerability warning-the black bar safety net

In the past two years has been focused on the browser aspect of the research, mainly in the Fuzz-based, fuzzing in the user state of vulnerability discovery, whether it is a vulnerability in quality or CVE outputs have been good results. Until some big players involved, as well as a large number ...

Mezzanine 4.2.0 - Cross-Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Mezzanine 4.2.0 Fixed in: 4.2.1 Fixed Version Link: https://github.com/stephenmcd/mezzanine/releases/tag/4.2.1 Vendor Website: http://mezzanine.jupo.org/ Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor:...

FUDforum 3.0.6 - Cross-Site Scripting / Cross-Site Request Forgery

Security Advisory - Curesec Research Team 1. Introduction Affected Product: FUDforum 3.0.6 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://fudforum.org/forum/ Vulnerability Type: XSS, Login CSRF Remote Exploitable: Yes Reported to vendor: 04/11/2016 Disclosed to public:...

FUDforum 3.0.6 - Local File Inclusion

Security Advisory - Curesec Research Team 1. Introduction Affected Product: FUDforum 3.0.6 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://fudforum.org/forum/ Vulnerability Type: LFI Remote Exploitable: Yes Reported to vendor: 04/11/2016 Disclosed to public: 11/10/2016 Release...