Information about L1 Terminal Fault findings

Palo Alto Networks is aware of recent vulnerability disclosures, known as L1 Terminal Fault, that affect modern CPU architectures. At this time, our findings show that these vulnerabilities pose no increased risk to Palo Alto Networks PAN-OS devices. CVE-2018-3615, CVE-2018-3620, and CVE-2017-364...

The Dangers of Client Probing on Palo Alto Firewalls

While performing a routine internal penetration test, I began the assessment by running Responder in analyze mode just to get an idea of what was being sent over broadcast. Much to my surprise, I found that shortly after running it, a hash was captured by Responders SMB listener...

80 to 0 in Under 5 Seconds: Falsifying a Medical Patient's Vitals

ARCHIVED STORY 80 to 0 in Under 5 Seconds: Falsifying a Medical Patient's Vitals By Douglas McKee · August 11, 2018 The author thanks Shaun Nordeck, MD, for his assistance with this report. With the explosion of growth in technology and its influence on our lives, we have become increasingly...

Qualys Cloud Platform 2.34 New Features

This release of the Qualys Cloud Platform version 2.34 includes updates and new features for Cloud Agent, EC2 Connector, Continuous Monitoring, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. Cloud Agent Automatic Merge of Cloud...

IBM Security Identity Governance and Intelligence Information Disclosure Vulnerability (CNVD-2018-24616)

IBM Security Identity Governance and Intelligence IGI is a suite of identity management and governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. A security vulnerability exists in IBM Securi...

CVE-2018-14933

upgradehandle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Carbon Black Announces Cb LiveOps, a New Offering on the Cb Predictive Security Cloud (PSC), Delivering Real-Time Query and Response

Today is another exciting day for Carbon Black! Earlier, we announced the release of Cb LiveOps™- the newest offering built on our Cb Predictive Security Cloud™ PSC. a platform delivering complete endpoint prevention, detection, and response, all from a single agent. Cb LiveOps extends core...

CVE-2018-12940

SeedDMS before 5.1.8 has an unrestricted file upload in the file op/op.UploadChunks.php (parameter qqfile ). An authenticated attacker can upload a file with an executable extension, upload a malicious PHP payload, and execute OS commands from the web root. This vulnerability is documented as CVE...

Davolink DVW-3200N

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Davolink Equipment: DVW-3200N Vulnerability: Use of Password Hash With Insufficient Computational Effort 2. RISK EVALUATION Successful exploitation of this vulnerability may result in a remote...

AVEVA Wonderware License Server

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/Low skill level to exploit Vendor: AVEVA Software, LLC AVEVA Equipment: Wonderware License Server Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of...

Oracle JRockit JVM Detection (Linux/Unix SSH Login)

Detects the installed version of Oracle JRockit JVM. The script logs in via ssh, searches for SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SAQ Enables Users to Pick and Choose Questions for Custom Templates

Qualys Security Assessment Questionnaire SAQ has been enhanced with new features for questionnaire templates, which enable customers to choose questions that they want to include in their campaigns. The new Question Bank option in the SAQ Template Editor provides users with a repository of...

motorcycletirereviews.com XSS vulnerability

Open Bug Bounty ID: OBB-647853 Description| Value ---|--- Affected Website:| motorcycletirereviews.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Fedora 27 : 1:nodejs (2018-79841c871e)

Update for security fixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Conservation of Threat

Here's some interesting research about how we perceive threats. Basically, as the environment becomes safer we basically manufacture new threats. From an essay about the research: To study how concepts change when they become less common, we brought volunteers into our laboratory and gave them a...

https-redirect NSE Script

Check for HTTP services that redirect to the HTTPS on the same port. Example Usage nmap -sV Requires comm string shortport nmap url local comm = require "comm" local string = require "string" local shortport = require "shortport" local nmap = require "nmap" local url = require "url" local U =...

OS Security Patch Assessment Checks Not Supported

OS Security Patch Assessment is not available for this host because the checks may be infeasible or are not supported by Nessus. The credentials supplied in the scan policy may have been successful, but OS Security Patch Assessment cannot be performed at this time. C Tenable Network Security, Inc...

Indonesian Penetration Testing LFS: Dracos Linux

Dracos Linux is the Linux operating system from Indonesian, open source is built based on the Linux From Scratch under the protection of the GNU General Public License v3.0. This operating system is one variant of Linux distributions, which is used to perform security testing penetration testing...

rr.getran.com.br XSS vulnerability

Open Bug Bounty ID: OBB-635662 Description| Value ---|--- Affected Website:| rr.getran.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Qualys Cloud Platform (VM, SCA, PC) 8.14 New Features

This new release of the Qualys Cloud Platform VM, SCA, PC, version 8.14, includes several new feature improvements across the apps such as Wallix AdminBastion support, EC2 scan improvements, VM reporting improvements, ESX/ESXi PC support for vCenter, PC STIG Report, and expanded technology suppor...