Internet Bug Bounty: Flash local-with-fileaccess Sandbox Bypass

The proof of concept attached will exploit the implementation of flash in some browsers that will bypass the local-with-fileaccess sandbox. By encoding in ignored file:// uri characters, and navigating to another page with a decoder script. one is able to read arbitrary files AND parse it to the...

Microsoft Office Word Remote Code Execution Vulnerabilities (2916605)

This host is missing an important security update according to Microsoft Bulletin MS14-001. OpenVAS Vulnerability Test $Id: secpodmswinwordms14-001.nasl 6715 2017-07-13 09:57:40Z teissa $ Microsoft Office Word Remote Code Execution Vulnerabilities 2916605 Authors: Antu Sanadi Copyright: Copyright...

Debian Security Advisory DSA 2825-1 (wireshark - several vulnerabilities)

Laurent Butti and Garming Sam discovered multiple vulnerabilities in the dissectors for NTLMSSPv2 and BSSGP, which could lead to denial of service or the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2825.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA...

PT-2014-70: Cross-Site Scripting in Jahia CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Jahia CMS. Reflected cross-site scripting in the usersearch.jsp page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser...

openSUSE: Security Advisory for ca-certificates-mozilla (openSUSE-SU-2013:1891-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2013-76: Local File Inclusion in LiveStreet CMS

The specialists of the Positive Research center have detected a Local File Inclusion vulnerability in LiveStreet CMS. Insufficient validation of user input in the install\index.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may...

Debian Security Advisory DSA 2813-1 (gimp - several vulnerabilities)

Murray McAllister discovered multiple integer and buffer overflows in the XWD plugin in Gimp, which can result in the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2813.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2813-1 using nvtgen 1.0 Script...

PT-2013-80: Improper input validation in SIMATIC WinCC Open Architecture

The specialists of the Positive Research center have detected an Improper input validation vulnerability in SIMATIC WinCC Open Architecture. The SIMATIC WinCC OA integrated Web server at Port 4999/TCP might allow attackers to perform a denial of service attack on the SIMATIC WinCC OA monitoring...

Debian Security Advisory DSA 2802-1 (nginx - restriction bypass)

Ivan Fratric of the Google Security Team discovered a bug in nginx, a web server, which might allow an attacker to bypass security restrictions by using a specially crafted request. The oldstable distribution squeeze is not affected by this problem. OpenVAS Vulnerability Test $Id: deb2802.nasl 66...

openSUSE: Security Advisory for kernel (openSUSE-SU-2013:0925-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for Mozilla (openSUSE-SU-2013:1334-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Digital Signatures Denial of Service Vulnerability (2868626)

This host is missing an important security update according to Microsoft Bulletin MS13-095. OpenVAS Vulnerability Test $Id: secpodms13-095.nasl 5346 2017-02-19 08:43:11Z cfi $ Microsoft Windows Digital Signatures Denial of Service Vulnerability 2868626 Authors: Shashi Kiran N Copyright: Copyright...

Debian Security Advisory DSA 2791-1 (tryton-client - missing input sanitization)

Cedric Krier discovered that the Tryton client does not sanitize the file extension supplied by the server when processing reports. As a result, a malicious server could send a report with a crafted file extension that causes the client to write any local file to which the user running the client...

Debian Security Advisory DSA 2790-1 (nss - uninitialized memory read)

A flaw was found in the way the Mozilla Network Security Service library nss read uninitialized data when there was a decryption failure. A remote attacker could use this flaw to cause a denial of service application crash for applications linked with the nss library. The oldstable distribution...

Debian Security Advisory DSA 2778-1 (libapache2-mod-fcgid - heap-based buffer overflow)

Robert Matthews discovered that the Apache FCGID module, a FastCGI implementation for Apache HTTP Server, fails to perform adequate boundary checks on user-supplied input. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially...

PT-2013-90: Unauthorized Access in Emerson DeltaV

The specialists of the Positive Research center have detected an Unauthorized Access vulnerability in Emerson DeltaV. A Local attacker with user privileges can read configuration file to obtain sensitive information. User name and password for the DeltaVAdmin account are stored in plaintext. How ...

PT-2013-67: Sensitive Information Disclosure in Serv-U File Server

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in Serv-U File Server. This vulnerability allows an attacker to find out the system configuration and obtain users’ authentication information via Serv-U variables values. Exploitation...

PT-2013-68: Sensitive Information Disclosure in Serv-U File Server

The specialists of the Positive Research center have detected a Sensitive Information Disclosure vulnerability in Serv-U File Server on Windows. The system does not consider that NTFS allows users to address files with extended syntax, while matching the requested resource URL with locations...

Debian Security Advisory DSA 2767-1 (proftpd-dfsg - denial of service)

Kingcope discovered that the modsftp and modsftppam modules of proftpd, a powerful modular FTP/SFTP/FTPS server, are not properly validating input, before making pool allocations. An attacker can use this flaw to conduct denial of service attacks against the system running proftpd resource...

Software Defense Series: Exploit mitigation and vulnerability detection

Software Defense is a broad topic requiring a multipronged approach including: - the processes and tooling associated with secure development that we try and encapsulate within the Microsoft SDL, - core OS countermeasures that make exploitation of a given vulnerability more difficult for an...