Accenture's blog shares an exploitation exercise for CVE-2020-1062, a recent Internet Explorer (IE) use-after-free (UAF) vulnerability. Read more.

Back in October 2019 we detected a classic watering-hole attack that exploited a chain of Google Chrome and Microsoft Windows zero-days. In this blog post we’d like to take a deep technical dive into the attack.

In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Pengsu Cheng and Yazhi Wang of the Trend Micro Research Team detail a recent code execution vulnerability in Microsoft Windows. The bug was originally discovered and reported by Zhipeng Huo (@R3dF09) of Tencent Sec

~450K QNAP NAS devices were vulnerable to a pre-auth root RCE, which chains multiple CVSS-9.8 vulnerabilities. ALL QNAP models were…

Posted by Natalie Silvanovich, Project Zero While there have been several rumours and reports of fully remote vulnerabilities affecting ...

This post explores the potential abuse of some features within the macOS Calendar application. It covers multiple attack paths that could lead to code execution and discusses the protections Apple has in place to mitigate them.

This is a special post because I fully based on another researcher, s1guza’s 0day. All of this story began from the following tweet: Siguza told us that his 0day was patched in the iOS 13.5 beta3. So this is actually a sandbox escape 0day for the newest, non-beta iOS version (13.4.1). In this post, I’ll show you how I reproduced that bug and wrote a malicious application that uses that 0day to steal the iMessage history!

TL;DR You can run an arbitrary command on a VMware Fusion guest VM through a website without any priory knowledge. Basically VMware Fusion is starting up a websocket listening only on the localhost. You can fully control all the VMs (also create/delete snapshots, whatever you want) through this websocket interface, including launching apps. You need to have VMware Tools installed on the guest for launching apps, but honestly who doesn’t have it installed.

With some luck and a couple of XSS bugs I was able to break the new Edge

This is a blog post about how I found three vulns and chained them to get RCE in the Microsoft AttackSurfaceAnalyzer (ASA moving forward) GUI version. ASA uses Electron.NET which binds the internal Kestrel web server to 0.0.0.0. If permission is given to bypass the Windows OS firewall (or if used on an OS without one), a remote attacker can connect to it and access the application. The web application is vulnerable to Cross-Site Scripting (XSS). A remote attacker can submit a runID with embedded JavaScript that is executed by the victim using the ASA Electron application. Electron.NET does ...

Techincal walkthrough

This is the first documented case of one-click mobile exploits used to target Tibetan groups, and reflects an escalation in the sophistication of digital espionage threats targeting the community.

Click to view Frederik's blog post

In December of 2018, we received a report of a vulnerability in Microsoft Office from Andrea Micalizzi, also known as rgod, who is one of our frequent contributors. It was patched this April as CVE-20…

CVE-2019-1208, a use-after-free vulnerability, could corrupt valid data, crash a process, and enable arbitrary or remote code execution.

分享奇虎360公司的技术，与安全的互联网共同成长。

We show that security controls put in place by iot device manufacturers are insufficient against attacks carried out by remote adversaries. This research project aimed to uncover and leverage new tech…

Server-Side Template Injection isn't exactly a new vulnerability in the world of web applications. It was made famous in 2015 by James Kettle in his famous blogpost on PortSwigger blog. In this post, …

Revisiting Helpviewer.app to hack Parallels for Mac

Application security issues found by Assetnote

本文是对我在Bluehat Shanghai 2019演讲内容的一个拓展性总结。在本文中，我将总结2010年到2018年出现的Office相关0day/1day漏洞。我将对每种类型的漏洞做一次梳理，并对每个漏洞的相关分析文章进行引用和归类。

Take a look into how custom URI schemes can be used to leverage underlying vulnerabilities in applications.

On the last day of 2018, I discovered a type confusion vulnerability in Internet Explorer that yields a clean write-what-where primitive. It patched this April as CVE-2019-0752 . As an exercise, I wro…

Jaroslav Lobačevski Joplin ElectronJS based Client: from XSS to RCE