LG SuperSign EZ CMS 2.5 - Local File Inclusion Vulnerability

Exploit for hardware platform in category web applications Exploit Title: LG SuperSign EZ CMS 2.5 - Local File Inclusion Exploit Author: Alejandro Fanjul Vendor Homepage: https://www.lg.com/ar/software-lg-supersign Version: SuperSign EZ CMS Tested on: Web OS 4.0 CVE : CVE-2018-16288 More info:...

LG SuperSign EZ CMS 2.5 - Local File Inclusion

Exploit Title: LG SuperSign EZ CMS 2.5 - Local File Inclusion Date: 2018-09-13 Exploit Author: Alejandro Fanjul Vendor Homepage: https://www.lg.com/ar/software-lg-supersign Version: SuperSign EZ CMS Tested on: Web OS 4.0 CVE : CVE-2018-16288 More info:...

Stack overflow

Microsoft ADFS 4.0 Windows Server 2016 and previous Active Directory Federation Services has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls...

CVE-2018-16794

Microsoft ADFS 4.0 Windows Server 2016 and previous Active Directory Federation Services has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls...

Open redirect

The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter...

SynaMan 4.0 build 1488 - SMTP Credential Disclosure Vulnerability

Exploit for windows platform in category web applications Exploit Author: bzyo CVE: CVE-2018-10814 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Cleartext password SMTP settings Date: 09-12-18 Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.htm Versio...

SynaMan 4.0 build 1488 - Authenticated Cross-Site Scripting Vulnerability

Exploit for windows platform in category web applications Exploit Author: bzyo CVE: CVE-2018-10763 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Authenticated Cross Site Scripting XSS Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.htm Version: 4.0...

Default credentials

Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials...

SynaMan 4.0 build 1488 - SMTP Credential Disclosure

Exploit Author: bzyo CVE: CVE-2018-10814 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Cleartext password SMTP settings Date: 09-12-18 Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.htm Version: 4.0 build 1488 Software Link:...

SynaMan 4.0 build 1488 - (Authenticated) Cross-Site Scripting

Exploit Author: bzyo CVE: CVE-2018-10763 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Authenticated Cross Site Scripting XSS Date: 09-12-18 Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.htm Version: 4.0 build 1488 Software Link:...

SynaMan 4.0 build 1488 - (Authenticated) Cross-Site Scripting

SynaMan 4.0 build 1488 - Authenticated Cross-Site Scripting Exploit Author: bzyo CVE: CVE-2018-10763 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Authenticated Cross Site Scripting XSS Date: 09-12-18 Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.ht...

SynaMan 4.0 Build 1488 Cross Site Scripting

Exploit Author: bzyo CVE: CVE-2018-10763 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Authenticated Cross Site Scripting XSS Date: 09-12-18 Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.htm Version: 4.0 build 1488 Software Link:...

SynaMan 40 Build 1488 SMTP Credential Disclosure

Exploit Author: bzyo CVE: CVE-2018-10814 Twitter: @bzyo Exploit Title: SynaMan 4.0 - Cleartext password SMTP settings Date: 09-12-18 Vulnerable Software: SynaMan 4.0 build 1488 Vendor Homepage: http://web.synametrics.com/SynaMan.htm Version: 4.0 build 1488 Software Link:...

Security Bulletin: IBM Content Collector for SAP Application is affected by a side channel attack vulnerability in GSKit

Summary IBM Content Collector for SAP Applications has addressed the following vulnerability: OpenSSL which is part of GSKit Crypto, could allow a local attacker to obtain sensitive information by a side-channel attach against a system based on Intel Sandy-Bridge microarchitecture. An attacker...

CVE-2018-1000639

LatexDraw version =4.0 contains a XML External Entity XXE vulnerability in SVG parsing functionality that can result in disclosure of data, server side request forgery, port scanning, possible rce. This attack appear to be exploitable via Specially crafted SVG file...

Threatlist: Manufacturing, a Top Target for Espionage

When it comes to cyberattack-related reconnaissance and lateral movement activity, the manufacturing industry exhibits higher than normal rates. That’s according to Vectra’s 2018 Spotlight Report on Manufacturing, which crunched data from more than 4 million devices and workloads from customer...

CVE-2017-16654

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

CVE-2018-14593

An issue was discovered in Open Ticket Request System OTRS 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL...

CVE-2018-14773

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a legacy IIS header that lets users override the path in the request URL via the...

Don't let your factory plant become the next cybersecurity victim

In 2014, a smart refrigerator had been caught red-handed for spawning over 750,000 spam emails after hijacked by a botnet attack. It is the first documented attack worldwide for Internet of Things to have fallen prey to hackersi. A more recent case in the US concerns an internet connected...