Tango DropBox v3.1 PRO - ActiveX Heap Spray Exploit

Document Title: =============== Tango DropBox v3.1 PRO - ActiveX Heap Spray Exploit References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1529 View Video: https://www.youtube.com/watch?v=jOCGPNzqkXg Release Date: ============= 2015-06-17 Vulnerability Laboratory ID VL-ID:...

US Navy Soliciting Zero Days

The National Security Agency may find and purchase zero days, but that doesn’t mean it’s sharing its hoard with other government agencies such as the U.S. Navy, which apparently is in the market for some unpatched, undisclosed vulnerabilities of its own. A request for proposal posted last...

TinySRP Buffer Overflow

Dear Fulldisclosure, I submitted the below vulnerability to the HP Zero Day Initiative. They responded that they are not interested in vulnerabilities in this "product". Further, I tried to contact one of the authors Eric A. Young; the email bounced. I am busy with my day job and do not have the...

Wassenaar, Bug Bounties and Vulnerability Rewards Programs

Bug bounties have gone from novelty to necessity, not only for enterprises looking to take advantage of the skills of an organized pool of vulnerability hunters, but also for a slew of independent researchers who make a living contributing to various vendor and independent bounty and reward...

Unity Web Player Zero-Day Vulnerability Disclosed

Some detail has been disclosed about a zero-day vulnerability in the Unity Web Player browser plugin that can allow an attacker to use a victim’s credentials to read messages or otherwise abuse their access to online services. The partial disclosure was made after nearly six months of bug-report...

Apple Mac OSX Zero-Day Bug Allows Hackers to Install RootKit Malware

A zero-day software vulnerability discovered deep in the firmware of many Apple computers could allows an attacker to modify the system’s BIOS and install a rootkit, potentially gaining complete control of the victim’s Mac. The critical vulnerability, discovered by well-known OS X security...

Apple Blocks Older Versions of Flash Player

On the heels of a major Adobe Flash Player update two weeks ago, Apple last night updated its blacklist to include older versions of the software. In its advisory, Apple said it will begin blocking out-of-date versions of Flash in its Safari browser. “If you’re using an out-of-date version of the...

APT Group Embeds C&C Data on TechNet Pages

The so-called Deputy Dog APT group has surfaced again with a means of keeping its command and control servers under wraps that involves Microsoft’s TechNet online resources. New research published last week by Microsoft and FireEye revealed targeted attacks against organizations have been...

MacKeeper Zero Day Remote Code Execution Vulnerability

A controversial piece of security and maintenance software for Mac OS X computers, known as MacKeeper, has been found to be vulnerable to a critical remote code execution vulnerability. MacKeeper antivirus software for Mac OS X is designed to improve Mac performance and security, but it is infamo...

MacKeeper URL Handler Remote Code Execution Exploit

Exploit for macOS platform in category remote exploits !/usr/bin/python """ SecureMac has released an advisory on a vulnerability discovered today with MacKeeper. The advisory titled MacKeeper URL handler remote code execution vulnerability and proof-of-concept Zero-Day contains the latest...

WordPress Sites Backdoored, Leaking Credentials

WordPress site administrators just cannot come up for air. With a raft of WordPress vulnerabilities—most of them in plugins—to address, now comes word that a number of sites running the content management system have been compromised and are sending credentials via a backdoor to a criminal group...

MacKeeper - URL Handler Remote Code Execution

!/usr/bin/python """ SecureMac has released an advisory on a vulnerability discovered today with MacKeeper. The advisory titled MacKeeper URL handler remote code execution vulnerability and proof-of-concept Zero-Day contains the latest information including vulnerability, proof of concept and...

MacKeeper - URL Handler Remote Code Execution

MacKeeper - URL Handler Remote Code Execution !/usr/bin/python """ SecureMac has released an advisory on a vulnerability discovered today with MacKeeper. The advisory titled MacKeeper URL handler remote code execution vulnerability and proof-of-concept Zero-Day contains the latest information...

Apple Fixes WebKit Vulnerabilities in Safari Browser

Apple has updated its Safari browser, fixing a handful of exploitable WebKit flaws in various versions of Safari. WebKit is the core layout engine responsible for rendering webpages in the Safari browser. The first bulletin, vulnerabilities uncovered by Apple, resolves multiple memory corruption...

Routers Vulnerable to Critical Remote Code Execution Vulnerability

A zero day vulnerability in popular household routers from D-Link and Trendnet could be exploited by attackers to run arbitrary code on devices. The flaw, which can be exploited without authentication, is present in version 1.3 of Realtek’s SDK, which figures into some brands of routers, accordin...

WordPress CartPress Plugin Zero Day Disclosure

Another round of WordPress vulnerability disclosures has taken place with details made public on a handful of unpatched bugs in the CartPress ecommerce plugin. These disclosures come on the heels of a separate disclosure of a zero-day in the WordPress core engine. Those vulnerabilities have since...

Hacking WordPress Website with Just a Single Comment

Most of the time, we have reported about WordPress vulnerabilities involving vulnerable plugins, but this time a Finnish security researcher has discovered a critical zero-day vulnerability in the core engine of the WordPress content management system. Yes, you heard it right. The WordPress CMS...

Wordpress Stored Cross-Site Scripting Zero Day Vulnerability

WordPress security issues have for the most part involved a vulnerable plug-in, but a Finnish researcher has disclosed some details on a zero-day vulnerability he discovered in the WordPress 4.2 and earlier core engine that could lead to remote code execution on the webserver. Juoko Pynnonen of...

New Dark Web Marketplace Offers Zero-Day Exploits to Hackers

Hackers have sold secrets of zero-day exploits in the underground Dark Web marketplace such as the Silk Road and its various successors for years, and now a new deep web marketplace has appeared that offers anonymity protection to its sellers. A new Dark Web market, called "TheRealDeal," has open...

Zero-Day Market Economics Favor Incentives for Defensive Tools

There’s a security truism that goes something like this: Defenders must protect all machines against all vulnerabilities, while attackers need only to find one way on to a system or network. It’s a nearly unwinnable game for those in charge of defending corporate networks and securing web-based...