ICS-CERT Alert on Easily Hackable Road Signs

A new, remotely exploitable vulnerability in Daktronics’ Vanguard software could make it even easier for attackers to hack electronic road signs, a task that was reportedly never very difficult to begin with. Daktronics’ Vanguard dynamic highway message sign configuration software was initially...

Teracom Modem T2-B-Gawv1.4U10Y-BI Cross Site Request Forgery

Exploit Title: Teracom Modem CSRF Vulnerability Date: 20-04-2014 Author: Rakesh S Software Link: http://www.teracom.in/ Version: T2-B-Gawv1.4U10Y-BI The vulnerability exists due to insufficient validation of HTTP request origin. A remote attacker can trick a logged-in administrator to visit a...

Teracom Modem T2-B-Gawv1.4U10Y-BI - Cross-Site Request Forgery

Exploit Title: Teracom Modem CSRF Vulnerability Date: 20-04-2014 Author: Rakesh S Software Link: http://www.teracom.in/ Version: T2-B-Gawv1.4U10Y-BI The vulnerability exists due to insufficient validation of HTTP request origin. A remote attacker can trick a logged-in administrator to visit a...

Scout - Download and analyze webpage components to identify infected files

Uses the Pinpoint engine to download and analyze webpage components to identify infected files. Scout has a built-in HTTP Request Simulator that will render user-specified HTML files, catch the resulting HTTP requests, then drop the responses. Scout includes the ability to screenshot the webpage...

Cisco WSA HTTP Header Injection Vulnerability

A vulnerability in the web framework of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could cause a web page redirection to a possible malicious website. The vulnerability is due to insufficient validation of user input befor...

Google Chrome ScopedClipboardWriter::WritePickledData任意代码执行漏洞

Bugtraq ID:66252 CVE ID:CVE-2014-1714 Google Chrome是一款流行的WEB浏览器。 Google Chrome中ScopedClipboardWriter::WritePickledData函数ui/base/clipboard/scopedclipboardwriter.cc没有正确校验部分格式值漏洞，允许远程攻击者利用漏洞构建恶意WEB页，诱使用户解析，可使应用程序崩溃或执行任意代码。 0 Google Chrome Chrome 33.0.1750.152和33.0.1750.154已经修复该漏洞，建议用户下载更新：...

MS14-012: Cumulative security update for Internet Explorer: March 11, 2014

Resolves vulnerabilities in Internet Explorer that could allow remote code execution if a user views a specially crafted webpage in Internet Explorer.The update that this article describes has been replaced by a newer update. We recommend that you install the most current cumulative security upda...

Microsoft Office Excel Record Parsing Use After Free (MS11-072) - Ver2 (CVE-2011-1986)

A remote code execution vulnerability has been reported in Microsoft Office Excel. The vulnerability is due to lack of validation of certain record structures while handling specially crafted Excel files. A remote attacker could trigger this vulnerability by enticing an unsuspecting user to open ...

Lexmark Printer config.html Administrator Authentication Bypass

The version of the remote Lexmark printer is potentially affected by a security bypass vulnerability. An input validation error exists related to the webpage 'config.html' and the 'vac.255.GENPASSWORD' parameter that could allow an attacker to change the administrator password to a blank string. ...

Oracle Java JNDI Sandbox Bypass (CVE-2014-0422)

A sandbox bypass vulnerability exists in Oracle Java. The vulnerability is due to the insecure getContextClassLoader method in the JNDI component. A remote unauthenticated attacker can exploit this vulnerability by enticing a user to visit a webpage containing a maliciously crafted Java applet...

Microsoft Windows Graphics Component CVE-2014-0263 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file or webpage. A successful exploit may allow arbitrary code to run in the context of the currently logged-in user. Failed...

Microsoft Internet Explorer Null Byte Information Disclosure - Ver2 (CVE-2012-0012)

An information disclosure vulnerability has been reported in Microsoft Internet Explorer. A remote attacker could exploit this vulnerability by enticing target users to open a specially crafted webpage. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitiv...

[Pinpoint] Enumerates WebPage Components to help identify the Infected Files

Pinpoint works like wget/curl in that it just fetches a webpage without rendering any script. Pinpoint will then try to determine which links are used to make up the webpage such as Javascript, CSS, frames, and iframes and downloads those files too some Javascript content will produce incorrect...

[Ghost Phisher v1.5] GUI suite for phishing and penetration attacks

Ghost Phisher is an application of security which comes built-in with a fake DNS server ,DHCP server fake, fake HTTP Server and also has a space for the automatic capture and recording credentials HTTP method of the form to a database. The program could be used for on-demand service of DHCP, DNS,...

Microsoft Windows CVE-2013-5056 Use-After-Free Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed...

Microsoft Windows InformationCardSigninHelper Class ActiveX Control Code Execution - ver 2 (CVE-2013-3918)

A remote code execution vulnerability exists in the InformationCardSigninHelper Class ActiveX control, icardie.dll. When the InformationCardSigninHelper Class ActiveX control is instantiated in Internet Explorer, the control may corrupt the system state in such a way that an attacker could run...

Assessing risk for the November 2013 security updates

Today we released eight security bulletins addressing 19 CVE’s. Three bulletins have a maximum severity rating of Critical while the other five have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Assessing risk for the October 2013 security updates

Today we released eight security bulletins addressing 25 CVE’s. Four bulletins have a maximum severity rating of Critical while the other four have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Microsoft Silverlight CVE-2013-3896 Information Disclosure Vulnerability

Description Microsoft Silverlight is prone to an information-disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow attackers to gain access to potentially sensitive information that may aid in furthe...

Oracle Java Runtime Environment ShortComponentRaster.verify Memory Corruption (CVE-2013-2472)

A memory corruption vulnerability exists in Oracle's Java Runtime. The vulnerability is due to insufficient input validation on ShortComponentRaster.verify method parameters which will lead to bypassing of "dataOffsets0" boundary checks when the "numDataElements" field is 0. A remote attacker can...