[IPv6 Toolkit v1.5.2] A security assessment and troubleshooting tool for the IPv6 protocols

A security assessment and troubleshooting tool for the IPv6 protocols. Changelog v1.5.2 Add support for GNU Debian/kfreebsd. The toolkit would not build on GNU Debian/kfreebsd before this release. Add support for TCP/IPv6 probes. tcp6 can now send TCP/IPv6 packets “–probe-mode” option, and read t...

Assessing risk for the January 2014 security updates

Today we released four security bulletins addressing six CVE’s. All four bulletins have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin...

[Memoryze] Find Evil in Live Memory (Memory Forensic Software)

Mandiant’s Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis. Mandiant’s Memoryze features: image the full range of system memory no...

PT-2014-68: Multiple SQL Injection in InstantCMS

The specialists of the Positive Research center have detected multiple SQL Injection vulnerabilities in InstantCMS. SQL Injection in the cms.php script allows remote attackers to execute arbitrary SQL commands via a specially crafted request. How to fix Update your software up to the latest...

CVE-2013-2068

creationtimestamp| type| source ---|---|--- 2013-12-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/30469 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/cfmemanageiqevmuploadexec.rb 2025-02-06 03:13:41+00:0...

[SSLDigger v1.02] Tool to assess the strength of SSL

SSLDigger v1.02 is a tool to assess the strength of SSL servers by testing the ciphers supported. Some of these ciphers are known to be insecure. Features: full Browser Support using Microsoft Internet Explorer Browser Control support for operating the tool in batch modefor operating on multiple...

PT-2013-75: Cross-Site Scripting in Nuxeo Platform

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Nuxeo Platform. Cross-site scripting in the login.jsp page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to f...

PT-2014-78: Cross-site scripting in Kasseler CMS

The specialists of the Positive Research center have detected a Cross-site scripting vulnerability in Kasseler CMS. Insufficient validation of user input in the \function\init.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may...

PT-2014-75: Cross-Site Scripting in Kasseler CMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Kasseler CMS. Cross-site scripting in the install.php page allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to f...

Assessing risk for the December 2013 security updates

Today we released eleven security bulletins addressing 24 CVE’s. Five bulletins have a maximum severity rating of Critical while the other six have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Up.Time Monitoring Station post2file.php Arbitrary File Upload

This Metasploit module exploits an arbitrary file upload vulnerability found within the Up.Time monitoring server 7.2 and below. A malicious entity can upload a PHP file into the webroot without authentication, leading to arbitrary code execution. This module requires Metasploit:...

Kaseya uploadImage Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Kaseya uploadImage Arbitrary File Upload', 'Description' = %q This module exploits an arbitrary file upload vulnerability found in...

DesktopCentral AgentLogUpload Arbitrary File Upload Vulnerability

This Metasploit module exploits an arbitrary file upload vulnerability in DesktopCentral 8.0.0 below build 80293. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution. This module requires Metasploit: http//metasploit.com/download...

Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability found within the Up.Time monitoring server 7.2 and below. A malicious entity can upload a PHP file into the webroot without authentication, leading to arbitrary code execution. Although the vendor fixed Up.Time to prevent this...

Kaseya < 6.3.0.2 - Arbitrary File Upload

, , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. Kaseya Arbitrary File Upload Vulnerability Affected versions: User-Agent: Mozilla/5.0 Windows NT 6.1; rv:22.0 Gecko/20100101 Fir...

ManageEngine Desktop Central 8.0.0 build 80293 - Arbitrary File Upload

ManageEngine Desktop Central 8.0.0 build 80293 - Arbitrary File Upload , , . .' '. ', . , '. , ., , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' ='"=. presents.. DesktopCentral Arbitrary File Upload Vulnerability Affected versions: DesktopCentral...

Assessing risk for the November 2013 security updates

Today we released eight security bulletins addressing 19 CVE’s. Three bulletins have a maximum severity rating of Critical while the other five have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your...

Wordpress Scanner

Detects Wordpress Versions, Themes, Plugins, and Users This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress Scanner', 'Description' = 'Detects Wordpress Versions, Themes, Plugins, and...

[Umap] The USB host security assessment tool

umap is a tool which allows you to test the security of USB host implementations i.e. something you plug a USB device into, like a PC or a tablet. Its primary function at the moment is a fuzzer with test cases based on a combination of data from standards documentation and the author's experience...

Final Draft 8 File Format Stack Buffer Overflow

require 'msf/core' class Metasploit3 'Final Draft 8 File Format Stack Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow in Final Draft 8. Multiple fields are vulnerable to the overflow, however in is the only field to accept mixed-case characters. , 'License'...