Showing 7 results for: 2015 ×Zero-Day ×

Zero-day in Magmi database client for popular e-commerce platform Magento targeted in the wild

Magento is the most popular e-commerce platform owned by eBay since 2011. We illustrate how a severe security flaw can be introduced into a Magneto based e-commerce system, when installing a commonly used vulnerable version of the open-source Magmi utility and failing to change the default security configuration. The appearance of HTTP requests attempting to exploit this vulnerability in the wild indicates that some bad actors are onto this method as well. Once successful, the attacker gains the Magento site credentials and the encryption key for the Magento database.

Tsar Team Microsoft Office Zero Day CVE-2015-2424

After the publication of Flash and IE zero days following the Hacking Team leak, researchers have discovered the use of another zero-day vulnerability by the Tsar Team sometimes referred to as the APT28 and Operation Pawn Storm. iSIGHT Partners discovered...

A Flash Exploit (CVE-2015-5119) From the Hacking Team Leak

***Update July 12, 2015--It was recently discovered that Hacking Team possessed an additional zero-day exploit for Adobe Flash--CVE-2015-5122. CVE-2015-5122 was patched by Adobe on July 8, 2015. While a different exploit than CVE-2015-5119 discussed below, Trustwave SWG customers are also...