Oracle Java JNDI Sandbox Bypass (CVE-2014-0422)

A sandbox bypass vulnerability exists in Oracle Java. The vulnerability is due to the insecure getContextClassLoader method in the JNDI component. A remote unauthenticated attacker can exploit this vulnerability by enticing a user to visit a webpage containing a maliciously crafted Java applet...

Microsoft Windows Graphics Component CVE-2014-0263 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file or webpage. A successful exploit may allow arbitrary code to run in the context of the currently logged-in user. Failed...

Microsoft Internet Explorer Null Byte Information Disclosure - Ver2 (CVE-2012-0012)

An information disclosure vulnerability has been reported in Microsoft Internet Explorer. A remote attacker could exploit this vulnerability by enticing target users to open a specially crafted webpage. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitiv...

[Pinpoint] Enumerates WebPage Components to help identify the Infected Files

Pinpoint works like wget/curl in that it just fetches a webpage without rendering any script. Pinpoint will then try to determine which links are used to make up the webpage such as Javascript, CSS, frames, and iframes and downloads those files too some Javascript content will produce incorrect...

[Ghost Phisher v1.5] GUI suite for phishing and penetration attacks

Ghost Phisher is an application of security which comes built-in with a fake DNS server ,DHCP server fake, fake HTTP Server and also has a space for the automatic capture and recording credentials HTTP method of the form to a database. The program could be used for on-demand service of DHCP, DNS,...

Microsoft Windows CVE-2013-5056 Use-After-Free Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed...

Microsoft Windows InformationCardSigninHelper Class ActiveX Control Code Execution - ver 2 (CVE-2013-3918)

A remote code execution vulnerability exists in the InformationCardSigninHelper Class ActiveX control, icardie.dll. When the InformationCardSigninHelper Class ActiveX control is instantiated in Internet Explorer, the control may corrupt the system state in such a way that an attacker could run...

Assessing risk for the November 2013 security updates

Today we released eight security bulletins addressing 19 CVE’s. Three bulletins have a maximum severity rating of Critical while the other five have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Assessing risk for the October 2013 security updates

Today we released eight security bulletins addressing 25 CVE’s. Four bulletins have a maximum severity rating of Critical while the other four have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Microsoft Silverlight CVE-2013-3896 Information Disclosure Vulnerability

Description Microsoft Silverlight is prone to an information-disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a malicious webpage. Successful exploits will allow attackers to gain access to potentially sensitive information that may aid in furthe...

Oracle Java Runtime Environment ShortComponentRaster.verify Memory Corruption (CVE-2013-2472)

A memory corruption vulnerability exists in Oracle's Java Runtime. The vulnerability is due to insufficient input validation on ShortComponentRaster.verify method parameters which will lead to bypassing of "dataOffsets0" boundary checks when the "numDataElements" field is 0. A remote attacker can...

Assessing risk for the September 2013 security updates

Today we released thirteen security bulletins addressing 47 CVE’s. Four bulletins have a maximum severity rating of Critical while the other ten have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Oracle Java java.awt.image.ByteComponentRaster Memory Corruption (CVE-2013-2473)

A code execution vulnerability has been reported in Oracle Java Runtime. The vulnerability is due to a memory corruption error in the ByteComponentRaster class from jre/bin/awt.dll. A remote attacker can exploit this vulnerability by enticing a user to open a malicious webpage. Successful...

Oracle Java java.awt.image.IntegerComponentRaster Memory Corruption (CVE-2013-2471)

A code execution vulnerability has been reported in Oracle Java Runtime. The vulnerability is due to a memory corruption error in the IntegerComponentRaster class from jre/bin/awt.dll. A remote attacker can exploit this vulnerability by enticing a user to open a malicious webpage. Successful...

Assessing risk for the August 2013 security updates

Today we released eight security bulletins addressing 23 CVE’s. Three bulletins have a maximum severity rating of Critical while the other five have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Attackers Targeting MS13-055 IE Vulnerability

Attackers are using an Internet Explorer vulnerability, which Microsoft patched yesterday, in targeted attacks that also employ a malicious Flash file installed through a drive-by download launched by compromised Web pages. The exploit that’s being used is capable of bypassing both ASLR and DEP...

Assessing risk for the July 2013 security updates

Today we released seven security bulletins addressing 34 CVE’s. Six bulletins have a maximum severity rating of Critical, and one has a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulleti...

JVN#85804149: CLIP-MAIL vulnerable to cross-site scripting

CLIP-MAIL provided by KENT-WEB contains an issue in the webpage output of strings entered in the form, which may result in a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version accordin...

Assessing risk for the June 2013 security updates

Today we released five security bulletins addressing 23 CVE’s. One bulletin has a maximum severity rating of Critical, and four have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin...

Microsoft Internet Explorer CVE-2013-0811 Use-After-Free Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...