Microsoft Internet Explorer textNode Use-After-Free

Joomla! <= 3.0.2 (highlight.php) PHP Object Injection Vulnerability

Java Applet JMX Remote Code Execution

According to the latest news, exploit kits such as Cool EK and Popads are integrating a new exploit for Java, targeting Java 7u11. An exploit for CVE-2013-0431 has been analyzed and shared by SecurityObscurity, and is also now available as a Metasploit module with some improvements for testability. We would like to use this blog post to share some details about the vulnerabilities abused by this new Java exploit.

2012 exploitable vulnerabilities timeline

CVE-2012-5088 Java Applet Method Handle RCE Metasploit Demo

This module abuses the Method Handle class from a Java Applet to run arbitrary Java code outside of the sandbox. The vulnerability affects Java version 7u7 and earlier.

CVE-2012-5076 Java Applet AverageRangeStatisticImpl RCE Metasploit Demo

This module abuses the AverageRangeStatisticImpl from a Java Applet to run arbitrary Java code outside of the sandbox, a different exploit vector than the one exploited in the wild in November of 2012. The vulnerability affects Java version 7u7 and earlier.