Hewlett Packard Enterprise Intelligent Management Center perfInsListServer Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

Synology Photo Station 6.7.3-3432 / 6.3-2967 Remote Code Execution

''' Source: https://blogs.securiteam.com/index.php/archives/3356 Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: Upload arbitrary files to the specified directories Log in with a fake authentication mechanism Log in to Photo Station with any identi...

CVE-2017-11131

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for...

Weblate: DKIM records not present, Email Hijacking is possible.....

Your SPF record is present attachments : spf Which very well shows that you don't want spoofed email to be sent from your domains, but you just forget one thing: DKIM DomainKeys Identified Mail is an important authentication mechanism to help protect both email receivers and email senders from...

CVE-2017-7660

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious...

CVE-2017-8386: using the less command to bypass the git-shell limit-vulnerability warning-the black bar safety net

git-shell git remote session on the introduction of a ssh tunnel, is a restricted shell. Its the basic idea behind is, in the ssh session limit to be able to execute the command, so that it can only execute git needs the appropriate command. git needs to execute the command as follows:...

StringBleed: SNMP Protocol“God mode”vulnerability affects a variety of network devices-vulnerability warning-the black bar safety net

Recently, data from South America, two security researchers discovered that the SNMP（Simple Network Management Protocol the v1 and v2 version of the Protocol the presence of the authorized authentication and access control bypass vulnerability, at least 78 kinds of models of network access and Io...

Cisco Prime Home Authentication Bypass Vulnerability

Cisco Prime Home is prone to an authentication-bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

D-Links Wi-Fi Camera in the presence of a vulnerability will affect more than 1 2 0 different products-vulnerability warning-the black bar safety net

! According to foreign media reports, security experts discovered a software plug-in, this component will be D-Links Wi-Fi camera is exposed to a remote attack risk. In addition, making the current situation worse, in the company's products, there are about 1 2 0 more products are using this...

Password Autocorrect Without Compromising Security

Intuitively, auto-correcting passwords would seem to be a terrible idea, and the worst security-for-convenience tradeoff in technology history. But a team of academics from Cornell University, MIT and a Dropbox security engineer say that the degradation of security from the introduction of such a...

Zend Framework < 1.12.4 Multiple Vulnerabilities

Binary data 9150.prm...

Nissan Nissan Leaf electric car, and vulnerability-exposure-vulnerability warning-the black bar safety net

Recently, a famous security researcher revealed that some of the Nissan Nissan its Nissan Leaf electric car is vulnerable to hacker attacks, the vehicle-mounted system vulnerability will allow an attacker to hijack a car's air conditioning and temperature control system. ! Troy Hunt reported that...

Cisco ASR 5000 Series StarOS SSH Subsystem Privilege Escalation Vulnerability

A privilege escalation vulnerability in the SSH subsystem in Cisco ASR 5000 Series devices running StarOS could allow an authenticated, remote attacker to elevate privileges. The attacker would need to have a valid and configured SSH authorized key and access to the same device from which the...

IOT security: LED lights there are multiple security vulnerabilities-vulnerability warning-the black bar safety net

Recently, there are foreign security experts found Zengge company WIFI LED lamp in the presence of a plurality of security vulnerabilities. Shenzhen levy Aurora Mega science and technologyZENGGE is a set of LED Controller product development, manufacturing, sales and engineering design,...

ATutor 2.2 Session Variable Overloading Vulnerability

ATutor versions 2.2 and below suffer from a session variable overloading vulnerability. ---------------------------------------------------------------------- ATutor = 2.2 confirm.php Session Variable Overloading Vulnerability ----------------------------------------------------------------------...

Gratipay: DKIM records not present, Email Hijacking is possible

Your SPF record is v=spf1 include:email.freshdesk.com include:spf.mandrillapp.com include:spf.google.com -all Which very well shows that you don't want spoofed email to be sent from your domains, but you just forget one thing: DKIM DomainKeys Identified Mail is an important authentication mechani...

Microsoft Windows 'Netlogon' Service CVE-2015-2374 Remote Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges within the context of the affected system. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPilot 5.0 Avaya CallPilot 5.0....

Rockwell Automation MicroLogix 1100 PLC < FRN 10.0 Authentication Mechanism DoS

Binary data scadarockwellmicrologix1100plcdos278864.nbin...

Apache Spark Cluster 1.3.x - Arbitrary Code Execution

Exploit Title: Arbitary Code Execution in Apache Spark Cluster Date: 23/03/2015 Exploit Author: AkhlD AkhilDas CodeBreach.in Vendor Homepage: https://spark.apache.org/ Software Link: https://spark.apache.org/downloads.html Version: All 0.0.x, 1.1.x, 1.2.x, 1.3.x Tested on: 1.2.1 Credits: Mayur...

Netsparker 4 - Easier to Use, More Automation and Much More Web Security Checks

Netsparker Web Application Security Scanner version 4. The main highlight of this new version is the new fully automated Form Authentication mechanism; it does not require you to record anything, supports 2 factor authentication and other authentication mechanisms that require a one time code to...