SAP NetWeaver - Hardcoded Credentials

Application: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: Hardcoded credentials Reported: 06.03.2014 Vendor response: 07.03.2014 Date of Public Advisory: 15.06.2015 Reference: SAP Security Note 2057982 Authors: Rustem Gazizov, Diana Grigorieva ERPScan VULNERABILITY INFORMATION Class:...

Popular Encryption Software TrueCrypt Shuts Down Mysteriously

TrueCrypt, the popular and reputed open source file and disk encryption Software for Windows, OSX and Linux, has abruptly closed down Wednesday recommending its users to use Microsoft's Bitlocker. TrueCrypt is a free, open-source and cross-platform encryption program, thereby one of the world's...

TrueCrypt Warns Software 'Not Secure,' Development Shut Down

Is it a hoax, or the end of the line for TrueCrypt? At the moment, there is little more than speculation as to the appearance today of an ominous note greeting visitors to the TrueCrypt page at SourceForge. The text warns that the open source encryption software is not secure and informs users th...

逐浪CMS特定版本疑似存在一个鸡肋后门

简要描述： 特定版本有。包我都是从官网下的啊，文件的来源引人遐想。 详细说明： Zoomla!CMS2X1.0和Zoomla!CMS2X1.1的插件文件夹下存在一个Plugins\baikeeditor\uploadsss.php 官方包下载地址： http://www.zoomla.cn/down/Zoomla!CMS2X1.0.rar http://www.zoomla.cn/down/Zoomla!CMS2x1.1.rar 其它版本均未存在此文件。 为什么说他鸡肋呢，先提下： 1.php的，需要在iis集成了php的组件时才可能有机会利用； 2.我一下子没想到他是否有更好的利用场景...

Multiple Vendors Router TCP Backdoor Remote Code Execution

A remote code execution vulnerability has been reported in Internet routers. The vulnerability is due to a TCP port backdoor. A remote attacker could exploit this vulnerability by sending a malicious request to a vulnerable router...

CoSoSys Endpoint Protector 4 SQL Injection / Backdoor

CoSoSys Endpoint Protector 4 suffers from remote SQL injection, unauthenticated access, information disclosure, and backdoor vulnerabilities. title: Multiple vulnerabilities product: CoSoSys Endpoint Protector 4 vulnerable version: all - except issue 1 fixed version: none - except issue 1 impact:...

CoSoSys Endpoint Protector 4 SQL Injection / Backdoor

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: CoSoSys Endpoint Protector 4 vulnerable version: all - except issue 1 fixed version: none ...

China Bans Microsoft Windows 8 for Government Computers

While US government is always prohibiting the purchase of Huawei products due to suspected backdoors from the Chinese government, China also keep itself totally apart from the US productions. China is a bit famous for using its own operating systems, smartphone application services and lots more,...

大汉Jvideo两处漏洞小合集（可能导致管理后台权限劫持）

简要描述： 两处。 详细说明： 一个是任意文件下载，一个是sql注入。 先看任意文件下载吧，任意文件下载可以下载到setup的相关安装信息，从而可以登录setup目录的管理后台 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/web.xml 来点好东西 http://222.66.10.88:8081/jvideo/down.jsp?pathfile=WEB-INF/ini/merpserver.ini 可以看见setup下Admin的密码（屏蔽了），登录成功 另外一个网站...

Seagate BlackArmor NAS - Multiple Vulnerabilities

Exploit Title: Seagate BlackArmor NAS Multiple Vulnerabilities Date: 2/17/14 Exploit Author: Shayan Sadigh twitter.com/r1pplex | Vendor Homepage: http://www.seagate.com/external-hard-drives/network-storage/ Version: All BlackArmor NAS devices.. Tested on: Linux CVE : N/A 1. some sort of backdoor...

Cisco recognized many routers have Backdoor vulnerability-vulnerability warning-the black bar safety net

Recently, Cisco released the latest security Advisory: cisco-sa-2 0 1 4 0 1 1 0-sbd, confirmed hacker Eloi Vanderbeken on Github exposing the backdoor vulnerability allows an attacker to locally bypass the authentication directly access the Management Interface. ! Security Bulletin display, the...

NIST removes Dual EC DRBG from SP 800-90A

The maligned Dual EC DRBG random number generator at the core of a $10 million secret contract between RSA Security and the National Security Agency has been removed from NIST’s draft guidance on random number generators. The National Institute for Standards and Technology said it will request...

Ninja PingU - High performance network scanner tool for large scale analyses

NINJA-PingU Is Not Just a Ping Utility is a free open-source high performance network scanner tool for large scale analyses. It has been designed with performance as its primary goal and developed as a framework to allow easy plugin creation. NINJA PingU comes out of the box with a set of plugins...

Routers TCP 32764 Backdoor Vulnerability Secretly Re-Activated Again

At the beginning of this year, we reported about the secret backdoor ‘TCP 32764’ discovered in several routers including, Linksys, Netgear, Cisco and Diamond that allowed an attacker to send commands to the vulnerable routers at TCP port 32764 from a command-line shell without being authenticated...

Sercomm TCP/32674 Backdoor Reactivation

Exploit for hardware platform in category remote exploits / PoC to reactivate Sercomm TCP/32674 backdoor See http://www.synacktiv.com/ressources/TCP32764backdooragain.pdf Eloi Vanderbeken - Synacktiv THIS SOFTWARE IS PROVIDED BY SYNACKTIV ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING...

Sercomm TCP/32674 - Backdoor Reactivation

/ PoC to reactivate Sercomm TCP/32674 backdoor See http://www.synacktiv.com/ressources/TCP32764backdooragain.pdf Eloi Vanderbeken - Synacktiv THIS SOFTWARE IS PROVIDED BY SYNACKTIV ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF...

Sercomm TCP32674 - Backdoor Reactivation

Sercomm TCP32674 - Backdoor Reactivation / PoC to reactivate Sercomm TCP/32674 backdoor See http://www.synacktiv.com/ressources/TCP32764backdooragain.pdf Eloi Vanderbeken - Synacktiv THIS SOFTWARE IS PROVIDED BY SYNACKTIV ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED...

Sercomm TCP/32674 Backdoor Reactivation

/ PoC to reactivate Sercomm TCP/32674 backdoor See http://www.synacktiv.com/ressources/TCP32764backdooragain.pdf Eloi Vanderbeken - Synacktiv THIS SOFTWARE IS PROVIDED BY SYNACKTIV ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF...

Cryptanalysis Remains for TrueCrypt Audit

Phase two of the TrueCrypt audit figures to be a labor-intensive, largely manual cryptanalysis, according to the two experts behind the Open Crypto Audit Project OCAP. Matthew Green, crypto expert and professor at Johns Hopkins University, said a small team of experts will have to, by hand, exami...

First Phase of TrueCrypt Audit Turns Up No Backdoors

A initial audit of the popular open source encryption software TrueCrypt turned up fewer than a dozen vulnerabilities, none of which so far point toward a backdoor surreptitiously inserted into the codebase. A report on the first phase of the audit was released today by iSEC Partners, which was...