Mysterious Hackers Hid Their Swiss Army Spyware for 5 Years

The TajMahal spyware includes more than 80 distinct spy tools, and went undetected for five years...

Discourse 'CVE-2019-5418' LFI Vulnerability - Active Check

Discourse is prone to a LFI Local File Inclusion vulnerability if the hosting system is running an outdated version of Ruby on Rails. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Siemens Warns of Critical Remote-Code Execution ICS Flaw

Siemens has released 16 security advisories for various industrial control and utility products, including a warning for a critical flaw in the WibuKey digital rights management DRM solution that affects the SICAM 230 process control system. SICAM 230 is used for a broad range of industrial contr...

Planet IP Camera Detection

Detection of Planet IP Camera. The script sends a connection request to the server and attempts to detect the web interface for Planet Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under t...

Denial of Service Vulnerability in Disk Pulse Enterprise Client Software

Disk Pulse Eneterprise is a software that monitors disk changes and can be connected to the software through an administration port 9120 or a web administration window 80. A denial of service vulnerability exists in the Disk Pulse Enterprise client software due to the diskpls.exe component servic...

Samsung Web Viewer DVR Remote Detection

Detects the installation of Samsung Web Viewer DVR. This script sends an HTTP GET request and tries to ensure the presence of Samsung Web Viewer DVR. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respectiv...

Debian DSA-4331-1 : curl - security update

Two vulnerabilities were discovered in cURL, an URL transfer library. - CVE-2018-16839 Harry Sintonen discovered that, on systems with a 32 bit sizet, an integer overflow would be triggered when a SASL user name longer than 2GB is used. This would in turn cause a very small buffer to be allocated...

Grandstream Web UI Detection

Detection of Grandstream Web UI. The script sends a connection request to the server and attempts to detect the Grandstream Web UI. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2018-14064

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80...

Directory traversal

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80...

CVE-2018-14064

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80...

CVE-2018-14064

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP port 80...

CVE-2018-14064

VelotiSmart WiFi B-380 cameras are affected by CVE-2018-14064 due to a Directory Traversal (LFI) in the uc-http service 1.0.0, exploitable via /../../etc/passwd on TCP port 80. The Nuclei template and related advisories confirm unauthenticated access can read arbitrary device files and sensitive ...

OX App Suite 7.8.4 XSS / XML Injection / Information Disclosure

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 58055 Bug ID Vulnerability type: XEE CWE-611 Vulnerable version: 7.8.4 Vulnerable component: office Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.3-rev37, 7.8.2-rev40, 7.8.3-rev48, 7.8.4-rev28...

OX App Suite 7.8.4 - Multiple Vulnerabilities

Exploit for multiple platform in category web applications Product: OX App Suite Vendor: OX Software GmbH Internal reference: 55872 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.8.4 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution...

OX App Suite 7.8.4 - Multiple Vulnerabilities

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 55872 Bug ID Vulnerability type: Cross-Site Scripting CWE-80 Vulnerable version: 7.8.4 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.3-rev30, 7.8.2-rev3...

OX App Suite 7.8.4 XSS / Privilege Management / SSRF / Traversal

Dear subscribers, we've migrated our public disclosure workflow to full-disclosure and are catching up on publishing recent vulnerabilities through this channel. Feel free to join our bug bounty programs open-xchange, dovecot, powerdns at HackerOne. Yours sincerely, Martin Heiland, Open-Xchange...

Security update for xen (important)

This update for xen to version 4.9.2 fixes several issues. This feature was added: - Added script, udev rule and systemd service to watch for vcpu online/offline events in a HVM domU. They are triggered via 'xl vcpu-set domU N' These security issues were fixed: - CVE-2018-8897: Prevent mishandlin...

SUSE SLES11 Security Update : xen (SUSE-SU-2018:1203-1) (Meltdown)

This update for xen fixes several issues. These security issues were fixed : - CVE-2018-8897: Prevent mishandling of debug exceptions on x86 XSA-260, bsc1090820 - Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially...

SUSE SLES11 Security Update : xen (SUSE-SU-2018:1181-1) (Meltdown)

This update for xen fixes several issues. These security issues were fixed : - CVE-2018-8897: Prevent mishandling of debug exceptions on x86 XSA-260, bsc1090820 - Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially...