CVE-2016-8361

CVE-2016-8361 affects Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The root cause is a hard-coded username with no password, enabling an attacker to gain access without authentication to the system. Exploitation could permit unauthenticated access and command execution, consistent with...

CVE-2016-8369

The CVE-2016-8369 entry affects Lynxspring JENEsys BAS Bridge versions 1.1.8 and older, with a Cross-Site Request Forgery (CSRF) vulnerability due to insufficient verification that user-submitted requests originated from the legitimate user. This could allow an attacker to perform actions with th...

CVE-2016-8357

The CVE-2016-8357 vulnerability affects Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept them, enabling an attacker with read-only access to cause changes within the application. This is describe...

CVE-2016-8378

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards for protecting credentials...

CVE-2016-8357

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands. This would allow an attacker with read-only access to make changes within the application...

CVE-2016-8378

CVE-2016-8378 affects Lynxspring JENEsys BAS Bridge

CVE-2016-8369

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application does not sufficiently verify if a request was intentionally provided by the user who submitted the request CROSS-SITE REQUEST FORGERY...

Bypassing Device-Resource Restrictions

Cordova is vulnerable to the bypass of intended device-resource restrictions. Leveraging on an event-based bridge, a library clone, and an IFRAME script execution, a remote attacker is able to wait for a certain amount of time for an OnJsPrompt handler return value as an alternative to correct...

Side Channel Attack On Modular Exponentiation

OpenSSL is vulnerable to side channel attacks. The vulnerability exploits cache-bank conflicts on the Intel Sandy-Bridge microarchitecture, exposing RSA keys. However, an attacker can only exploit this only if he has control of code in a thread running on the same hyper-threaded core as the victi...

Intel Processor Memory Sinkhole Vulnerability

Lenovo Security Advisory: LEN-3748 Summary: Memory Sinkhole Vulnerability Description: In August 2015 at the Black Hat security conference, researcher Chris Domas presented a vulnerability found in Intel x86 processors manufactured between 1997 and 2010 prior to the Sandy Bridge generation. Throu...

Hardware Bridge Server

This module sets up a web server to bridge communications between Metasploit and physically attached hardware. Currently this module supports: automotive This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework TODO: SSL...

Hardware Bridge Session Connector

The Hardware Bridge HWBridge is a standardized method for Metasploit to interact with Hardware Devices. This extends the normal exploit capabilities to the non-ethernet realm and enables direct hardware and alternative bus manipulations. You must have compatible bridging hardware attached to this...

Google Patches Android 'Custom Boot Mode' Vulnerability

A high-risk Android custom boot mode vulnerability was one of many bugs patched by Google as part of its January Android Security Bulletin released earlier this week. On Thursday, the IBM security team that discovered the vulnerability disclosed details about the flaw which leaves Nexus 6 and 6P...

RM Bridge - Native code usage, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application RM Bridge published at the 'play' market has multiple vulnerabilities...

Cloud Bridge: Upgrading Virtual WAN MCN from 8.1 to 9.0

An error occurred while transfer software to change management system. ret =-1, file = /tmp/CB-VW-PKG-9.0.1.31.UPG...

OpenSSL: Side channel attack on modular exponentiation

A side-channel attack was found that makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. An attacker who has the ability to control code in a thread running on the same hyper-threaded core as the victim's thread that is performing decryption, could use this flaw to...

JXBrowser JavaScript-Java bridge in the RCE vulnerability-vulnerability warning-the black bar safety net

I recently was studying how to use JXBrowser to achieve a set of experimental scanning techniques. When I use JXBrowser library in the process, I suddenly thought, whether it can be by calling different classes to attack the JXBrowser client, and through a Web page to achieve remote code executio...

Lynxspring JENEsys BAS Bridge Authentication Bypass Vulnerability

Lynxspring is a US based company.BAS Bridge is a web based SCADA system.BAS servers are deployed in areas such as commercial facilities, manufacturing, energy, water and wastewater systems and many more. An authentication bypass vulnerability exists in Lynxspring JENEsys BAS Bridge. Due to the la...

Lynxspring JENEsys BAS Bridge Elevation of Privilege Vulnerability

Lynxspring is a US based company.BAS Bridge is a web based SCADA system.BAS servers are deployed in areas such as commercial facilities, manufacturing, energy, water and wastewater systems and many more. An elevation of privilege vulnerability exists in Lynxspring JENEsys BAS Bridge. An attacker...

Lynxspring JENEsys BAS Bridge Cross-Site Request Forgery Vulnerability

Lynxspring is a US based company.BAS Bridge is a web based SCADA system.BAS servers are deployed in areas such as commercial facilities, manufacturing, energy, water and wastewater systems and many more. A cross-site request forgery vulnerability exists in Lynxspring JENEsys BAS Bridge. Due to th...