CVE-2014-1243

Apple QuickTime before 7.7.5 is affected by CVE-2014-1243 due to an uninitialized pointer in track list handling, allowing remote arbitrary code execution or a crash when processing crafted movie files. Exploitation is described in multiple sources (e.g., ZDI-14-044 states a nam atom parsing flaw...

NCH Software Express Burn Plus 4.68缓冲区溢出漏洞

NCH Software是适用于Windows和Mac OS X的音频，视频，听写，商业和计算机实用软件的厂商。 该漏洞是由于项目文件处理时的边界错误引起的，当用户打开例如特制的.EBP文件时，导致一个unicode缓冲区溢出。成功利用此漏洞可能允许执行任意代码。 0 NCH Software Express Burn Plus 4.68 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.nchsoftware.com/ use Cwd; use LWP::Simple; print "\n...

Target Corp. Suffers Black Friday Data Breach

UPDATE – TJX and Heartland Payment Systems may soon have company atop the list of the worst retail data breaches in U.S. history after reports surfaced that Target Corp. was breached around Black Friday and millions of credit and debit cards were stolen. Target confirmed the breach this morning a...

Dennis Fisher and Mike Mimoso Discuss Do Not Track, We Are the Cavalry and more

Dennis Fisher and Mike Mimoso discuss the major security stories of the last two weeks, including the BGP route hijacking, why Do Not Track doesn’t work and the We Are the Cavalry movement. Download: digitalunderground135.mp3...

MIRcon Preview: Why C-Level Executives Should Attend

Security conferences come and go and most are well attended by information security practitioners for professional development and networking. But what about the executives who are responsible for strategy and who hold the budgets - what conferences should they attend? With MIRcon 2013, Nov. 5-6,...

CrowdSource Tool Aims to Improve Automated Malware Analysis

When a new piece of malware surfaces, it’s typically analyzed eight ways from Sunday by a long list of antimalware and other security companies, government agencies, CERTs and other organizations who try to break it down and classify its capabilities. There’s a lot of duplicated effort there, and...

Pinterest Announces Support for DNT Header

Pinterest is the latest major Internet service to support Do Not Track. The social site, which allows its users to organize items of interest, made the announcement on Friday in a note that explained how it was going to suggest personalized pins based on websites the user has visited and placed a...

Mozilla Delays Third-Party Cookie Patch in Firefox

Mozilla has tapped the brakes on its plans to block third-party cookies by default in the Firefox browser. Test versions of Firefox 22, scheduled for a June release, were supposed to include a patch that blocked third-party cookie drops by default. However, Mozilla CTO Brendan Eich said yesterday...

Firefox 21 Launches with 3 critical fixes and new Social Integrations

Mozilla has launched Firefox 21 for Mac, Windows, and Linux, adding a number of improvements, namely to the browser's Social API. "Today, we are adding multiple new social providers Cliqz, Mixi and msnNOW to Firefox," wrote Mozilla in a blog post today. The browser first added Facebook integratio...

Firefox 21 Update Patches 8 Vulnerabilities, 3 Critical

Mozilla fixed eight vulnerabilities, three critical, in the 21st build of its flagship Firefox browser yesterday. One of the fixes remedies an Address Sanitizer memory corruption flaw MFSA 2013-48 that could’ve allowed remote code execution. The other two critical flaws could’ve also led to...

Firefox 21 Launches with 3 critical fixes and new Social Integrations

Mozilla has launched Firefox 21 for Mac, Windows, and Linux, adding a number of improvements, namely to the browser's Social API. "Today, we are adding multiple new social providers Cliqz, Mixi and msnNOW to Firefox," wrote Mozilla in a blog post today. The browser first added Facebook integratio...

[SPF v0.1.7] Smartphone Pentest Framework - Support of the SMS shell pivot

The smartphone penetration testing framework, the result of a DARPA Cyber Fast Track project, aims to provide an open source toolkit that addresses the many facets of assessing the security posture of these devices. We will look at the functionality of the framework including information gatherin...

How To: Chrome Browser Privacy Settings

youtube http://www.youtube.com/watch?v=YY9hbsfEbaw The Web browser is the primary portal through which the vast majority of connected users access and interact with the Internet. Each browser has its own security and privacy settings and those settings have an enormous impact on the nature of the...

More from CanSecWest 2013

Pwn2Own, Pwnium Attract Dollars and 0-Days by the Bushel Groundbreaking Cyber Fast Track Research Program Ending At Pwn2Own, Browser Exploits Getting Harder, More Expensive to Find Firefox, Java, Flash All Taken Down at Pwn2Own How Facebook Prepared to Be Hacked...

Mudge on the CFT

Peiter Zatko, also known as Mudge, has run the DARPA Cyber Fast Track program for the last three years, but he said that the researcher program is ending on April 1. The CFT program funded a wide range of security research projects in its time, including Charlie Miller’s NFC work and Moxie...

Groundbreaking Cyber Fast Track Research Program Ending

VANCOUVER–When Peiter Zatko, the security researcher and pioneering hacker known as Mudge, joined the federal government several years ago to help run a DARPA research program, some in the security industry wondered what effect someone with his background could have in an organization as famously...

CPOs Challenged with Meeting Privacy Expectations and Maintaining Full User Experience

SAN FRANCISCO – People who interact with online services have mounting privacy expectations that run in parallel with their need for a full experience with the functionality central to those services. But can users have their privacy cake and eat it too? That’s the challenging question facing...

FTC Endorses New Privacy Guidelines, Do Not Track for Mobile Apps, Devices

Hoping to ramp up privacy on mobile devices such as smartphones and tablets, the Federal Trade Commission FTC has released a series of suggestions to help app developers, advertising networks and device companies better protect their users online. As it’s done over the last two years with browser...

ProjektB CMS SQL Injection

Exploit Title : ProjektB Cms Sql Injection Vulnerability Author : IrIsT.Ir Discovered By : BeniVanda Home : http://www.IrIsT.Ir/forum Software Link : http://www.projektb.biz/ Security Risk : High Version : All Version Tested on : win7,BT,Ubuntu Dork : intext:"Design by ProjektB" Expl0iTs :...

Faux, Hacked Apps Continue to Litter Google Play Marketplace, Developer Alleges

Phony, potentially malicious apps are continuing to make their way into Google’s Play marketplace, triggering debate over whether applications are being properly vetted for adhering to the company’s marketplace policies. Developers at the Root Uninstaller Team have called out another app publishe...