ARRIS cable modems generate passwords deterministically and contain XSS and CSRF vulnerabilities

Overview Multiple models of ARRIS cable modems contain multiple, deterministically generated backdoor passwords, as well as multiple cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. Description CWE-255: Credentials Management - CVE-2009-5149The 'password of the day'...

Tableau Server Detection (HTTP)

HTTP based detection of a Tableau Server. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

SolarWinds Log and Event ManagerTrigeo SIM 6.1.0 - Remote Command Execution

SolarWinds Log and Event ManagerTrigeo SIM 6.1.0 - Remote Command Execution Requirements: Python 2.7 netcat Tested on: Ubuntu 14.04 LTS Vulnerable Appliance Version: 6.1.0 Download: http://downloads.solarwinds.com/solarwinds/Release/LEM/SolarWinds-LEM-v6.1.0-Evaluation-VMware.exe Instructions: Th...

SolarWinds Log and Event Manager/Trigeo SIM 6.1.0 - Remote Command Execution

Requirements: Python 2.7 netcat Tested on: Ubuntu 14.04 LTS Vulnerable Appliance Version: 6.1.0 Download: http://downloads.solarwinds.com/solarwinds/Release/LEM/SolarWinds-LEM-v6.1.0-Evaluation-VMware.exe Instructions: The exploitlem.py script will need to be run sudo since it uses sockets which...

SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1528-1)

Mozilla Firefox is being updated to the current Firefox 38ESR branch specifically the 38.2.0ESR release. Security issues fixed : - MFSA 2015-78 / CVE-2015-4495: Same origin violation and local file stealing via PDF reader - MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474: Miscellaneous memory safety...

Immunity Canvas: MS15_100

Name| ms15100 ---|--- CVE| CVE-2015-2509 Exploit Pack| CANVAS Description| ms15100 Notes| References: https://technet.microsoft.com/library/security/ms15-100 CVE Name: CVE-2015-2509 VENDOR: Microsoft NOTES: Tested on: Windows 7 SP132 bits Windows 7 SP164 bits Use port 80 as the server port Window...

Amazon Linux: Security Advisory (ALAS-2012-80)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Netsparker 2.3.X - Remote Code Execution Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Title : Netsparker 2.3.X - Remote Code Execution Tested on Netsparker 2.3.x / Win 7 Author : Hesam Bazvand E-Mail : email protected FaceBook : https://www.facebook.com/hesam.king73 Twitter : https://twitter.com/hesamking73...

Siemens SICAM MIC Authentication Bypass Vulnerability

Siemens SICAM MIC is a modular remote control device for energy automation belonging to the SICAM RTU product family. An authentication bypass vulnerability exists in Siemens SICAM MIC versions prior to 2404, which can be exploited by a remote attacker to perform administrator actions by accessin...

Bitcoin Cloud Mining Service Hacked; Database On Sale for Just 1 Bitcoin

Bitcoin Cloud Mining service Cloudminr.io has been hacked and its whole users database is on sale for 1 Bitcoin. The unknown hackers have successfully taken full control of the website's server and defaced the homepage of the website. Users visiting the website are greeted with a defaced homepage...

烽火（Fiberhome）HG-110 设备目录穿越漏洞

知道创宇安全研究团队 2015 . 03 . 31一.漏洞概要近期，国外安全研究员发布了针对全球 ADSL 设备存在目录穿越漏洞的研究网页链接1，这个漏洞早在 2011 年就被提出了，影响烽火（Fiberhome）HG-110 型号设备网页链接2，本着学习的态度，笔者对该漏洞进行了一番考证，写在这里。a）漏洞描述烽火（Fiberhome）HG-110 型号设备目录穿越漏洞网页链接3，是由于 webproc 文件在处理参数 getpage 传递过来的文件访问时没有合适过滤，导致用户可以利用 ../../ 跳转访问 web 目录之外的系统文件。b）漏洞分析烽火（Fiberhome）HG-11...

linux/x86 seanux-a 1.0 execve shellcode - 80 bytes

seanux-a Linux distribution is an operating system made as a collection of software based around the Linux kernel and often around a package management system. Most distributions come ready to use and pre-compiled for a specific instruction set, while others are distributed in source code form an...

Interactive Data eSignal Listener Buffer Overflow - Ver2 (CVE-2004-1868)

eSignal is a real-time market data and support tool provided by Interactive Data Corporation. The product supplies financial market data and more for traders over the internet. To facilitate the receipt of incoming data, eSignal opens a local, listening socket on TCP Port 80. There exists a buffe...

IT-Grundschutz M4.096: Abschaltung von DNS

IT-Grundschutz M4.096: Abschaltung von DNS. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4096.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.096 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone Networks GmbH,...

Anthem Data Breach — 6 Things You Need To Know

The Nation’s second largest Health insurer company, Anthem, alerted its customers on Wednesday that hackers had stolen the personal information of over 80 Millions of its customers, making it the largest data breach and double the number of payment cards affected by Target data breach occurred in...

Prolink PRN2001 - Multiple Vulnerabilities

Prolink PRN2001 - Multiple Vulnerabilities Exploit Title: Prolink PRN2001 Multiple Vulnerabilities 1. -Advisory Information- Title: Prolink PRN2001 Multiple Vulnerabilities Firmware: Ver 1.2 Firmware URL: http://www.prolink2u.com/download/fw/fwPRN2001V1.220130323.zip Vendor Homepage:...

EntryPass N5200 - Credentials Exposure

Advisory: EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of information that includes the current administrative username and password. Details ======= Product: EntryPass N5200 Active Network Control Panel Affected...

EntryPass N5200 Credential Disclosure Vulnerability

EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of information that includes the current administrative username and password. EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of...

EntryPass N5200 Credential Disclosure

Advisory: EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated downloading of information that includes the current administrative username and password. Details ======= Product: EntryPass N5200 Active Network Control Panel Affected...

CVE-2014-7084

The Hesheng 80 aka com.ireadercity.c29 application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...