Microsoft Internet Explorer and Edge CVE-2016-3325 Information Disclosure Vulnerability

Description Microsoft Internet Explorer and Edge are prone to an information disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Successful exploits will allow attackers to obtain sensitive information that may aid in...

ZKTeco ZKAccess Security System 5.3.1 - Persistent Cross-Site Scripting

Exploit for jsp platform in category web applications !-- ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability Vendor: ZKTeco Inc. | Xiamen ZKTeco Biometric Identification Technology Co.,ltd Product web page: http://www.zkteco.com Affected version: 5.3.12252 Summary: ZKAccess Systems ar...

Microsoft Edge browser vulnerability, allowing a hacker to execute arbitrary code

The vulnerability in Microsoft Edge’s Chakra JavaScript engine is caused by a buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code via a specially crafted web page from a remote location...

Microsoft Edge browser vulnerability, which allows a hacker to obtain confidential information from the process memory

The vulnerability of the VBScript kernel in Microsoft Edge browsers is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information from the process’s memory through a specially crafted web pa...

CVE-2016-3329

Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to determine the existence of files via a crafted webpage, aka "Internet Explorer Information Disclosure Vulnerability."...

Threat Outbreak Alert RuleID24041: Email Messages Distributing Malicious Software on August 3, 2016

Medium Alert ID: 48360 First Published: 2016 August 3 14:08 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID24041 may contain the following files: Name | Si...

The vulnerability of the Microsoft Lync Attendee User software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for remote execution of code exists in vulnerable components and is related to the processing of specially crafted font files. Exploiting this vulnerability enables remote execution of code, provided that the user opens a specially crafted file or webpage. Exploiting...

The vulnerability of Microsoft Lync Server software allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for remote execution of code exists in vulnerable components and is related to the processing of specially crafted font files. Exploiting this vulnerability enables remote execution of code, provided that the user opens a specially crafted file or webpage. Exploiting...

The vulnerability of the Mac OS X operating system and the iOS operating system allows a perpetrator to trigger a service failure or execute arbitrary code.

The vulnerability of the OpenGL component in the Mac OS X and iOS operating systems arises from buffer overflows. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely or cause a service failure memory corruption by using a specially crafted web page...

Mapbox: XSS on www.mapbox.com/authorize/ because of open redirect at /core/oauth/auth

Description --- When you load the endpoint https://www.mapbox.com/authorize/ a GET request is made to the endpoint https://www.mapbox.com/core/oauth/auth with the parameters passed in the request to https://www.mapbox.com/authorize/. If you only send the parameter redirecturi in the request to...

Google Chrome Autofill Memory Misreference Vulnerability

Google Chrome is a popular web browser. A memory misreference vulnerability exists in Google Chrome Autofill, which allows remote attackers to exploit the vulnerability to construct a malicious web page and trick users into parsing it, which can crash the application or execute arbitrary code...

Apple iOS WebKit Information Disclosure Vulnerability (CNVD-2016-03339)

Apple iOS is the United States Apple Apple company for mobile devices developed by a set of operating systems. WebKit is KDE, Apple Apple, Google Google and other companies jointly developed a set of open source Web browser engine, currently used by Apple Safari and Google Chrome and other...

Windows Graphics Component Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise a user’s system. There are multiple ways an attacker could exploit...

TH692 Outdoor P2P HD Waterproof IP Camera Hard-Coded Credentials

Exploit Title: TH692- Outdoor P2P HD Waterproof IP Camera hardcoded credentials Date: 4/16/2016 Exploit Author: DLY Vendor: TENVIS Technology Co., Ltd Product: TH692- Outdoor P2P HD Waterproof IP Camera Product webpage: http://www.tenvis.com/th-692-outdoor-p2p-hd-waterproof-ip-camera-p-230.html...

Quanta LTE Router Code Execution / Backdoor Accounts

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: Multiple vulnerabilities found in Quanta LTE routers backdoor, backdoor accounts, RCE, weak WPS ... Advisory URL: https://pierrekim.github.io/advisories/2016-quanta-0x00.txt Blog URL:...

Trend Micro Deep Discovery Inspector 3.7 / 3.8 CSRF

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-DDI-CSRF.txt Vendor: ==================== www.trendmicro.com Product: ========================================= Trend Micro Deep Discovery Inspector V3.8, 3.7 Deep...

Trend Micro Deep Discovery Inspector 3.8/3.7 - Cross-Site Request Forgery

Exploit for php platform in category web applications + Credits: John Page aka hyp3rlinx Vendor: ==================== www.trendmicro.com Product: ========================================= Trend Micro Deep Discovery Inspector V3.8, 3.7 Deep Discovery Inspector is a network appliance that gives you...

Trend Micro Deep Discovery Inspector 3.8/3.7 - Cross-Site Request Forgery

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/TRENDMICRO-DDI-CSRF.txt Vendor: ==================== www.trendmicro.com Product: ========================================= Trend Micro Deep Discovery Inspector V3.8, 3.7 Deep...

Microsoft Edge browser vulnerability, which allows a hacker to trigger a service failure or execute arbitrary code

The vulnerability of Microsoft Edge arises due to buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or trigger a denial-of-service attack memory corruption using a specially crafted web page...

Deluge of Apple Patches Fix Vulnerabilities in OS X, iOS, Safari, and More

In addition to fixing the serious crypto vulnerabilities in iMessage that surfaced yesterday, Apple also deployed patches for nearly all of its products, including Safari, OS X, iOS, Apple TV’s tvOS, and watchOS. The iOS update, 9.3, is arguably the most pressing given the cryptographic issue dug...