HP LoadRunner lrFileIOService ActiveX Control WriteFileBinary Input Validation Error

Added: 08/29/2013 CVE: CVE-2013-2370 BID: 61441 OSVDB: 95640 Background HP LoadRunner is a software performance testing solution. HP LoadRunner includes the lrFileIOService ActiveX control. Problem HP LoadRunner before 11.52 is vulnerable to remote code execution. The lrFileIOService ActiveX...

Warning : Java 6 vulnerable to zero-day exploit; added to Neutrino exploit kit

Hackers are using a new exploit for a bug in the out-of-date but popular Java 6 platform to attack victims, and has been added to a commercially available Neutrino exploit kit. The use of Java 6 still is prevalent, opening up a significant number of users to the threat. F-secure analyst Timo...

Warning : Java 6 vulnerable to zero-day exploit; added to Neutrino exploit kit

Hackers are using a new exploit for a bug in the out-of-date but popular Java 6 platform to attack victims, and has been added to a commercially available Neutrino exploit kit. The use of Java 6 still is prevalent, opening up a significant number of users to the threat. F-secure analyst Timo...

Cogent DataHub HTTP Server Buffer Overflow Vulnerability

This Metasploit module exploits a stack based buffer overflow on Cogent DataHub 7.3.0. The vulnerability exists in the HTTP server - while handling HTTP headers, a strncpy function is used in a dangerous way. This Metasploit module has been tested successfully on Cogent DataHub 7.3.0 Demo on...

Joomla Patches Blackhole Zero Day Vulnerability

Attackers have been abusing websites for months that are hosted on Joomla, WordPress and other content management platforms. One gaping vulnerability can open the door for a cybercrime group, for example, to build a formidable botnet, or lure victims to malware that can cash out a bank account or...

FBI Used Firefox Exploit to Shutdown Illegal Site Running on Tor Network

TOR is the dark side of the Internet, the so-called dark web, which provides a safe haven to privacy advocates but is also where drugs, assassins for hire and other weird and illegal activities can allegedly be traded. A claimed zero-day vulnerability in Firefox 17 was used by the FBI to identify...

Firefox Zero-Day Exploit used by FBI to shutdown Child porn on Tor Network hosting; Tor Mail Compromised

TOR is the dark side of the Internet, the so-called dark web, which provides a safe haven to privacy advocates but is also where drugs, child pornography, assassins for hire and other weird and illegal activities can allegedly be traded. A claimed zero-day vulnerability in Firefox 17 was used by...

FreeBSD-SA-13:07.bind

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:07.bind Security Advisory The FreeBSD Project Topic: BIND remote denial of service Category: contrib Module: bind Announced: 2013-07-26 Credits: Maxim Shudrak...

More on Office 2003 Zero Day Vulnerability Patch

This week’s patch and security advisory for a vulnerability in Microsoft Office is the perfect example of why enterprise administrators need to take Microsoft’s criticality ratings as a suggestion and not gospel. Microsoft pushed security update MS13-051 through on Tuesday with a rating of...

Microsoft FixIt Tool Blocks Java Attacks in IE

Java is a security headache, not just for users and Oracle, its provider, but also for other software companies that have to deal with it, as well. Microsoft has taken steps to address this problem by releasing a FixIt tool that is designed to block all of the Web-based Java attack vectors in...

VMSA-2013-0008:VMware vCenter Chargeback Manager Remote Code Execution

VMSA-2013-0008 VMware vCenter Chargeback Manager Remote Code Execution VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2013-0008 VMware Security Advisory Synopsis: VMware vCenter Chargeback Manager Remote Code Execution VMware Security Advisory Issue date: 2013-06-11 VMware...

Oracle WebCenter Content CheckOutAndOpen.dll ActiveX RCE

This Metasploit modules exploits a vulnerability found in the Oracle WebCenter Content CheckOutAndOpenControl ActiveX. This vulnerability exists in openWebdav, where user controlled input is used to call ShellExecuteExW. This Metasploit module abuses the control to execute an arbitrary HTA from a...

Google sets 7 Day deadline For vulnerability disclosure

Google will release details of any zero-day flaws it finds in software, if the affected vendor fails to issue a patch or disclose the issue itself within a week. Now, Google is shortening that timeline a good bit to just 7 days. "Based on our experience...we believe that more urgent action within...

Google sets 7 Day deadline For vulnerability disclosure

Google will release details of any zero-day flaws it finds in software, if the affected vendor fails to issue a patch or disclose the issue itself within a week. Now, Google is shortening that timeline a good bit to just 7 days. “Based on our experience...we believe that more urgent action within...

Researchers, Vendors Await Google Disclosure Fallout

The endless loop that is the disclosure debate got a jolt of energy yesterday when Google said it would support researchers’ disclosure of details on actively exploited critical vulnerabilities just seven days after the researcher has notified the vendor in question. Google hopes the policy...

Java Runtime Environment DriverManager doPrivileged block sandbox bypass

Added: 05/24/2013 CVE: CVE-2013-1488 BID: 58504 OSVDB: 91472 Background Oracle Java is a development platform for developing and deploying Java applications. It includes the Java Development Kit JDK and the Java Runtime Environment JRE. The JRE provides the minimum requirements for executing a Ja...

Windows zero day vulnerability publicly exposed by Google engineer

A Google security engineer has not only discovered a Windows zero-day flaw, but has also stated that Microsoft has a knack of treating outside researchers with great hostility. Tavis Ormandy, a Google security engineer, exposed the flaw on Full Disclosure, that could be used to crash PCs or gain...

Windows zero day vulnerability publicly exposed by Google engineer

A Google security engineer has not only discovered a Windows zero-day flaw, but has also stated that Microsoft has a knack of treating outside researchers with great hostility. Tavis Ormandy, a Google security engineer, exposed the flaw on Full Disclosure, that could be used to crash PCs or gain...

ReVuln Discovers Zero Day Vulns in Gaming Clients

Two video game researchers have discovered a slew of zero day vulnerabilities in the engines that run popular first person shooter games like “Quake 4,” “Monday Night Combat,” “Crysis 2” and “Homefront,” among others that could put their servers and the gamers who use them in danger. The flaws li...

Microsoft Patches IE Zero Day Used In Watering Hole Attack

Microsoft wasted no time today delivering a patch for the Internet Explorer 8 vulnerability being exploited in watering hole attacks carried out against the U.S. Department of Labor website and nine others worldwide. Today’s Patch Tuesday security updates also include a fix for IE vulnerabilities...