Mutiny 5 Arbitrary File Upload

This module exploits a code execution flaw in the Mutiny 5 appliance. The EditDocument servlet provides a file upload function to authenticated users. A directory traversal vulnerability in the same functionality allows for arbitrary file upload, which results in arbitrary code execution with roo...

Adobe Releases Security Update for ColdFusion

Adobe has released a security hotfix for ColdFusion 10, 9.0.2, 9.0.1, and 9.0 for Windows, Macintosh, and UNIX. This hotfix addresses a vulnerability CVE-2013-1389 that could allow a remote attacker to execute arbitrary code and a vulnerability CVE-2013-3336 that could permit an unauthorized user...

Anonymous Hackers Launch #OpUSA against US Banking and Government Agencies

OpUSA campaign is officially started, the day has come, today May 7 as announced by Anonymous, a coordinated online attack will hit Banking and government websites. The announcement made by popular group of hacktivists is creating great concerns between US security experts in charge of defense th...

Anonymous Hackers Launch #OpUSA against US Banking and Government Agencies

OpUSA campaign is officially started, the day has come, today May 7 as announced by Anonymous, a coordinated online attack will hit Banking and government websites. The announcement made by popular group of hacktivists is creating great concerns between US security experts in charge of defense th...

Microsoft Releases Security Advisory for Internet Explorer

Microsoft is investigating public reports of a remote code execution vulnerability in Internet Explorer 8 and is aware of attacks that attempt to exploit this vulnerability. This vulnerability may allow an attacker to execute arbitrary code if a user accesses a specially crafted website. Microsof...

Sensitive Army database of U.S. dams compromised by Chinese Hackers

U.S. intelligence agencies traced a recent cyber intrusion into U.S. Army database that holds sensitive information about vulnerabilities in U.S. dams. The U.S. Army Corps of Engineers National Inventory of Dams contains information about 79,000 dams throughout the country and tracks such...

GroundWork - 'monarch_scan.cgi' OS Command Injection (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3...

Comment Crew's Operation Beebus Stealing Drone Tech

FireEye experts have been tracking the Operation Beebus campaign for a few months now, and their latest research suggests that whomever is responsible for the attacks is ultimately interested in stealing drone technology-related secrets. Operation Beebus is an APT-style attack campaign targeting...

Apple Releases Security Updates for Safari

Apple has released security updates for Safari 6.0.4 WebKit to address multiple vulnerabilities. These vulnerabilities could allow a remote attacker to execute arbitrary code or cause a denial-of-service condition. Safari 6.0.4 WebKit updates are available for the following versions: OS X Lion...

Oracle Releases April 2013 Security Advisory

Oracle has released its Critical Patch Update for April 2013 to address 128 vulnerabilities across multiple products. This update contains the following security fixes: 4 for Oracle Database Server 29 for Oracle Fusion Middleware 6 for Oracle E-Business Suite 3 for Oracle Supply Chain Products...

Scams Exploiting Boston Marathon Explosion

Malicious actors are exploiting the April 15 explosions at the Boston Marathon in attempts to collect money intended for charities and to spread malicious code. Fake websites and social networking accounts have been set up to take advantage of those interested in learning more details about the...

WordPress Sites Targeted by Mass Brute-force Botnet Attack

US-CERT is aware of an ongoing campaign targeting the content management software WordPress, a free and open source blogging tool and web publishing platform based on PHP and MySQL. All hosting providers offering WordPress for web content management are potentially targets. Hackers reportedly are...

Google Releases Google Chrome 26.0.1410.57

Google has released Google Chrome 26.0.1410.57 for all Chrome OS devices to address a vulnerability. This vulnerability could allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review the Google Chrome Release blog entry and follow best-practice security...

Adobe Releases Security Updates for Adobe Flash Player

Adobe has released security updates for Adobe Flash Player. These vulnerabilities could potentially allow an attacker to take control of an affected system or cause a denial-of-service condition. Adobe has released updates to the following products: Adobe Flash Player 11.6.602.180 and earlier...

Adobe Releases Security Update for ColdFusion

Adobe has released a security hotfix for Adobe ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and UNIX to address multiple vulnerabilities. These vulnerabilities could allow an unauthorized user to bypass authentication controls. US-CERT recommends that users and administrators review...

Security Update Available for Adobe Shockwave Player

Adobe has released a security update for Adobe Shockwave Player 12.0.0.112 and earlier versions for Windows and Macintosh to address multiple vulnerabilities. These vulnerabilities could allow an attacker to execute arbitrary code on the affected system. US-CERT recommends that users and...

AirDroid vulnerability allows hackers to perform Dos attack from your Android device

A vulnerability in AirDroid application which provides wireless management of your Android phone or tablet from any browser on the same Wi-Fi network allow hackers to perform Dos attack from your Android device. Cross Site scripting or XSS vulnerability in the browser version of AirDroid allows a...

AirDroid vulnerability allows hackers to perform Dos attack from your Android device

A vulnerability in AirDroid application which provides wireless management of your Android phone or tablet from any browser on the same Wi-Fi network allow hackers to perform Dos attack from your Android device. Cross Site scripting or XSS vulnerability in the browser version of AirDroid allows a...

Android AirDroid Flaw Can Lead to XSS, DoS Attacks

A cross-site scripting XSS vulnerability exists in the browser version of AirDroid, a cloud management application for Google’s Android phones. According to an alert from the US-Computer Emergency Readiness Team US-CERT, at the current time, there is no patch planned and there is no logical...

Microsoft Releases April 2013 Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Windows, Office, Internet Explorer, Server Software, and Security Software as part of the Microsoft Security Bulletin summary for April 2013. These vulnerabilities could allow remote code execution, elevation of privilege,...