CVE-2017-16949

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...

Multiple OEM - nsd Remote Stack Format String (PoC)

Multiple OEM - nsd Remote Stack Format String PoC STX Subject: Remote Stack Format String in 'nsd' binary from multiple OEM Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis December 2017 PoC: https://github.com/mcw0/PoC Release date: December 14, 2017 Full...

Vivotek IP Cameras - Remote Stack Overflow (PoC)

Vivotek IP Cameras - Remote Stack Overflow PoC STX Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no credentials...

Accesspress Anonymous Post Pro < 3.2.0 - Arbitrary File Upload

Exploit Title: Unauthenticated Arbitrary File Upload Date: November 12, 2017 Exploit Author: Colette Chamberland Author contact: [email protected] Author homepage: https://defiant.com Vendor Homepage: https://accesspressthemes.com/ Software Link:...

WordPress Accesspress Anonymous Post Pro < 3.2.0 - Unauthenticated Arbitrary File Upload Vulnerab

Exploit for php platform in category web applications Date: November 12, 2017 Exploit Author: Colette Chamberland Author contact: email protected Author homepage: https://defiant.com Vendor Homepage: https://accesspressthemes.com/ Software Link:...

Accesspress Anonymous Post Pro 3.2.0 - Arbitrary File Upload

Accesspress Anonymous Post Pro 3.2.0 - Arbitrary File Upload Exploit Title: Unauthenticated Arbitrary File Upload Date: November 12, 2017 Exploit Author: Colette Chamberland Author contact: [email protected] Author homepage: https://defiant.com Vendor Homepage: https://accesspressthemes.com/...

Authentication Port Spoofing

Apache Qpid Broker-J is vulnerable to authentication port spoofing. An attacker can use an HTTP port to trick the library into using an authentication provider which is configured for a different port number referred to as the spoofed port. This becomes a vulnerability when the spoofed port has a...

Debian DSA-4054-1 : tor - security update

Multiple vulnerabilities have been found in Tor, a connection-based low-latency anonymous communication system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4054. The text itself is...

Anonymous Muslim Group Confusing ISIS with Porn and Fake News

By Waqas A couple of weeks ago, it was reported that a group of This is a post from HackRead.com Read the original post: Anonymous Muslim Group Confusing ISIS with Porn and Fake News...

OnionShare - Securely and anonymously share a file of any size

OnionShare lets you securely and anonymously share files of any size. It works by starting a web server, making it accessible as a Tor onion service, and generating an unguessable URL to access and download the files. It doesn't require setting up a server on the internet somewhere or using a thi...

Vivotek IP Cameras - Remote Stack Overflow

Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no credentials needed Firmware Vulnerable: Only 2017 versions...

Hack of Attack-for-Hire Service vDOS Snares New Mexico Man

A New Mexico man is facing federal hacking charges for allegedly using the now defunct attack-for-hire service vDOS to launch damaging digital assaults aimed at knocking his former employer's Web site offline. Prosecutors were able to bring the case in part because vDOS got massively hacked last...

Catalyst Mahara Anonymous Comments Vulnerability

Catalyst Mahara is a social networking system from Catalyst IT in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Catalyst Mahara versions 1.9 before 1.9.7, 1.10 before 1.10.5, and 15.04 before 15.04.2. An attacker could exploit...

What is cryptocurrency and why do cybercriminals love it?

Ever pretend you know what your friends are talking about because you want to sound smart and relevant—and then trap yourself in a lie? “Wow, looks like those hackers were mining for cryptocurrency. You know what cryptocurrency is, right?” “Oh yeah, totally. Cryptocurrency. Bad stuff. You know...

Uniview - Remote Command Execution Export Config (PoC)

Uniview - Remote Command Execution Export Config PoC STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config...

Uniview - Remote Command Execution / Export Config (PoC)

STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config http://IP:PORT/cgi-bin/main-cgi?json="cmd":255,"szUserName":"","u32UserLoginHandle":-1 -tcpdump- check active capture...

IBM BigFix Platform Elevation of Privilege Vulnerability

IBM BigFix Platform formerly IBM Tivoli Endpoint Manager is a system management software. IBM BigFix Platform 9.2 and 9.5 does not perform authentication checks on critical resources or functions, which could be exploited by a remote attacker to gain access to protected areas by an anonymous user...

CVE-2017-1222

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862...

Authentication flaw

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862...

CVE-2017-1222

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862...