Live Vulnerability Monitoring with Agents for Linux…and more

A few months ago, I shared news of the release of the macOS Insight Agent. Today, Im pleased to announce the availability of the the Linux Agent within Rapid7's vulnerability management solutions. The arrival of the Linux Agent completes the trilogy that Windows and macOS began in late 2016. For...

October CMS 1.0.412 Code Execution / Shell Upload Vulnerabilities

Exploit for php platform in category web applications October CMS v1.0.412 several vulnerabilities Information =========== Name: October CMS v1.0.412 build 412 Homepage: http://octobercms.com Vulnerability: several issues, including PHP code execution Prerequisites: attacker has to be authenticat...

Oracle Hospitality OPERA 5 Property Services Remote Vulnerability (CNVD-2017-05849)

Oracle OPERA Property is a Cisco asset management system. A remote security vulnerability exists in the Oracle Hospitality OPERA 5 Property Services component, which can be exploited by remote attackers to compromise system confidentiality...

adviser.aberdeen-asset.co.uk XSS vulnerability

Vulnerable URL: https://adviser.aberdeen-asset.co.uk/ukadviser/?s=1%22/%3E%3CsvG/onLoad=prompt%28/OPENBUGBOUNTY/%29%3E&search-type;=normal Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

IBM Maximo Asset Management Security Bypass Vulnerability (CNVD-2017-05474)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A security bypa...

IT Asset Inventory Systems and CMDBs: A Marriage Made in InfoSec Heaven

A key capability of an IT asset inventory system is being able to exchange data with CMDBs Configuration Management Databases. In fact, a common misconception is that organizations with CMDBs don’t need an IT asset inventory system because their functions overlap. While they have similar roles,...

Installing OpenVAS 9 from the sources

In last month Greenbone Networks and OpenVAS development team have finally presented new OpenVAS 9 with new GUI, improved multi-scanner support, improved asset management, etc. We have been waiting for this release for 2 years! Upd. Please note, that entire procedure for separating scanners onto...

Rapid7 Nexpose in 2017

Last year I tested Rapid7 Nexpose and wrote two posts about installation and use of Nexpose Community Edition and Nexpose API. I didn't follow news of this vendor for a about year. Today I watched live demo of Nexpose latest version. It has some new interesting features, improvements and ideas,...

OSINT Gathering Tool: Inquisitor

OSINT Gathering Tool Inquisitor is a simple for gathering information on companies and organizations through the use of Open Source Intelligence OSINT sources. The key features of Inquisitor include: 1. The ability to cascade the ownership label of an asset e.g. if a Registrant Name is known to...

inquisitor - OSINT Gathering Tool for Companies and Organizations

Inquisitor is a simple for gathering information on companies and organizations through the use of Open Source Intelligence OSINT sources. The key features of Inquisitor include: 1. The ability to cascade the ownership label of an asset e.g. if a Registrant Name is known to belong to the target...

CVE-2017-1124

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...

Design/Logic Flaw

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...

CVE-2017-1124

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...

CVE-2017-1124

CVE-2017-1124 affects IBM Maximo Asset Management core versions 7.6, 7.5 and 7.1 (and Maximo Asset Management Essentials) plus affected IBM Industry Solutions and Control Desk products when installed on a vulnerable core. Root cause: HTTP header injection enabling local information disclosure by ...

CVE-2017-1124

IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference : 1998053...

Local Information Disclosure Vulnerability in Multiple IBM Products

IBM is a global information technology and business solutions company.IBM Maximo Asset Management is an asset management lifecycle and workflow process management system. A local information disclosure vulnerability exists in several IBM products. These include IBM Maximo Asset Management, a...

media.aberdeen-asset.com XSS vulnerability

Vulnerable URL: http://media.aberdeen-asset.com/en/mediacentre/searchresults?vgnextkeyword=%22autofocus%2Fonfocus%3Dalert%2FOPENBUGBOUNTY%2F%2F%2F Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

aboutus.aberdeen-asset.com XSS vulnerability

Vulnerable URL: http://aboutus.aberdeen-asset.com/en/aboutus/search?vgnextkeyword=%22autofocus%2Fonfocus%3Dalert%2FOPENBUGBOUNTY%2F%2F%2F Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

ir.aberdeen-asset.com XSS vulnerability

Vulnerable URL: http://ir.aberdeen-asset.com/en/investorrelations/search?vgnextkeyword=%22autofocus%2Fonfocus%3Dalert%2FOPENBUGBOUNTY%2F%2F%2F Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

private.aberdeen-asset.co.uk XSS vulnerability

Vulnerable URL: http://private.aberdeen-asset.co.uk/en/ukretail/searchresults?vgnextkeyword=%22autofocus/onfocus=alert/OPENBUGBOUNTY/// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...