2014 Verizon Data Breach Investigations Report DBIR

The attention given to the Target data breach elevated concerns about point-of-sale hacks and got us reacquainted with RAM scrapers and other threats to retailers big and small. And while it’s been a noteworthy highlight to the annual Verizon Data Breach Investigations Report for the past few...

Microsoft Office Excel Label Record Buffer Overflow (MS11-021) - Ver2 (CVE-2011-0098)

A code execution vulnerability has been reported in Microsoft Office Excel. The vulnerability is due to a flaw in the parsing of Label record in Excel documents, causing a buffer overflow. Remote attackers can exploit this vulnerability by enticing target users to open a malicious Excel file. In ...

Microsoft Excel SERIES Record Parsing Code Execution (MS12-030) - Ver2 (CVE-2012-1847)

A remote code execution vulnerability has been reported in Microsoft Excel. The vulnerability is due to an error in the way Microsoft Excel handles memory when opening specially crafted Excel files. A remote attacker can exploit this issue by enticing a target user to open a specially crafted Exc...

CMS Studio Cross Site Scripting

Multiple Cross Site Scripting on CMS STUDIO Risk: Low CWE number: CWE-79 Date: 15/04/2014 Vendor: www.cmsstudio.info Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: index.php Exploit: http://host/index.php?spageid=xss...

Joomla Wrapper Cross Site Scripting

Cross Site Scripting on Joomla "comwrapper" Risk: Low CWE number: CWE-79 Date: 15/04/2014 Project: www.joomla.org Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: index.php?option=comwrapper&itemid= Exploit: -Target: http://host.com -Vuln. Fil...

Joomla BeaconDecode Cross Site Scripting

Cross Site Scripting on Joomla "combeacondecode" Risk: Low CWE number: CWE-79 Date: 14/04/2014 Project: www.joomla.org Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: index.php?option=combeacondecode&task= Exploit: - Target: http://site.com -...

FreeBSD远程拒绝服务漏洞

Bugtraq ID:66726 CVE ID:CVE-2014-1453 FreeBSD是一种UNIX操作系统，是由经过BSD、386BSD和4.4BSD发展而来的Unix的一个重要分支。 FreeBSD在转换目标文件句柄为vnode时存在锁顺序错误，这可导致死锁，造成拒绝服务。 0 FreeBS 目前厂商已经发布了升级补丁以修复漏洞，请下载使用： http://www.freebsd.org/security/index.html...

Oracle Internet Directory Pre-Authentication LDAP Denial of Service (CVE-2008-2595)

There exists a denial of service vulnerability in the Oracle Internet Directory. The vulnerability is due to a NULL pointer dereference error when processing LDAP requests. Remote unauthenticated attackers could exploit this vulnerability by sending a crafted LDAP request to create a denial of...

w3af Security Scanner

w3af is a vulnerability scanning product. Remote attackers can use w3af to detect vulnerabilities on a target server...

Nikto Security Scanner

Nikto is a vulnerability scanning product. Remote attackers can use Nikto to detect vulnerabilities on a target server...

LibWhisker Security Scanner

LibWhisker is a vulnerability scanning product. Remote attackers can use LibWhisker to detect vulnerabilities on a target server...

University Data Breaches Pose Threat to Students, Academic Openness

North Dakota State University administrators confirmed last week that hackers never accessed the personal information of more than 200,000 students, faculty and staff housed on the server they successfully infiltrated. This attack perfectly suits the modern hackers MO. They attack open systems...

JBroFuzz Security Scanner

JBroFuzz is a vulnerability scanning product. Remote attackers can use JBroFuzz to detect vulnerabilities on a target server...

WebShag Security Scanner

WebShag is a vulnerability scanning product. Remote attackers can use WebShag to detect vulnerabilities on a target server...

Microsoft Windows Shell MSHTA Script Execution in OLE Files (MS05-016) - Ver2 (CVE-2005-0063)

The Windows operating system provides facilities that make it possible to invoke different applications to handle different types of files. This makes it possible for a user to double click on a known image type file, for instance, and by that action launch the proper application to display or ed...

Data Breaches Show Difficulty of Defenders' Task

When attackers broke into the network of the University of Maryland last month, the university’s wasn’t sure how to react. The organization had never had a major security incident before, and this one qualified as major: 310,000 Social Security numbers and other information was gone. And then thr...

Nessus Security Scanner

Nessus is a vulnerability scanning product. Remote attackers can use Nessus to detect vulnerabilities on a target server...

Microsoft Windows IPv6 Router Advertisements Denial of Service (MS14-006; CVE-2014-0254)

A denial of service vulnerability has been reported in Microsoft Windows. The vulnerability is due to a design weakness in the IPv6 stack as it processes router advertisement packets. An attacker can exploit this vulnerability by sending a large number of specially crafted IPv6 packets to the...

DirBuster Security Scanner

DirBuster is a vulnerability scanning product. Remote attackers can use DirBuster to detect vulnerabilities on a target server...

Dexter, Project Hook Point of Sale Malware Still Prevalent

While the Target data breach may be in the rear view mirror, research this week shows it’s clear that many attackers are still using point of sale malware, namely Dexter and Project Hook, in active attacks. Researchers at Arbor Networks’ Security Engineering & Response Team ASERT looked at severa...