CVE-2016-8357

The CVE-2016-8357 vulnerability affects Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept them, enabling an attacker with read-only access to cause changes within the application. This is describe...

CVE-2016-8369

The CVE-2016-8369 entry affects Lynxspring JENEsys BAS Bridge versions 1.1.8 and older, with a Cross-Site Request Forgery (CSRF) vulnerability due to insufficient verification that user-submitted requests originated from the legitimate user. This could allow an attacker to perform actions with th...

CVE-2016-8378

CVE-2016-8378 affects Lynxspring JENEsys BAS Bridge

CVE-2016-8361: Use of Hard-coded Credentials

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application uses a hard-coded username with no password allowing an attacker into the system without authentication...

CVE-2016-8378: Undefined Security Weakness

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards for protecting credentials...

CVE-2016-8357: Undefined Security Weakness

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands. This would allow an attacker with read-only access to make changes within the application...

PT-2017-9638

Name of the Vulnerable Software and Affected Versions Lynxspring JENEsys BAS Bridge versions 1.1.8 and older Description An issue was discovered in the application where it uses a hard-coded username with no password, allowing an attacker to access the system without authentication. Recommendatio...

PT-2017-9649

Name of the Vulnerable Software and Affected Versions Lynxspring JENEsys BAS Bridge versions 1.1.8 and older Description The application's database lacks sufficient safeguards for protecting credentials. Recommendations For versions 1.1.8 and older, consider implementing additional security...

PT-2017-9635

Name of the Vulnerable Software and Affected Versions Lynxspring JENEsys BAS Bridge versions 1.1.8 and older Description A user with read-only access can send commands to the software, and the application will accept those commands, allowing an attacker to make changes within the application...

CVE-2016-8369: Cross-Site Request Forgery (CSRF)

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application does not sufficiently verify if a request was intentionally provided by the user who submitted the request CROSS-SITE REQUEST FORGERY...

PT-2017-9643

Name of the Vulnerable Software and Affected Versions Lynxspring JENEsys BAS Bridge versions 1.1.8 and older Description An issue was discovered where the application does not sufficiently verify if a request was intentionally provided by the user who submitted the request, which is related to...

Bypassing Device-Resource Restrictions

Cordova is vulnerable to the bypass of intended device-resource restrictions. Leveraging on an event-based bridge, a library clone, and an IFRAME script execution, a remote attacker is able to wait for a certain amount of time for an OnJsPrompt handler return value as an alternative to correct...

Side Channel Attack On Modular Exponentiation

OpenSSL is vulnerable to side channel attacks. The vulnerability exploits cache-bank conflicts on the Intel Sandy-Bridge microarchitecture, exposing RSA keys. However, an attacker can only exploit this only if he has control of code in a thread running on the same hyper-threaded core as the victi...

Intel Processor Memory Sinkhole Vulnerability

Lenovo Security Advisory: LEN-3748 Summary: Memory Sinkhole Vulnerability Description: In August 2015 at the Black Hat security conference, researcher Chris Domas presented a vulnerability found in Intel x86 processors manufactured between 1997 and 2010 prior to the Sandy Bridge generation. Throu...

Hardware Bridge Server

This module sets up a web server to bridge communications between Metasploit and physically attached hardware. Currently this module supports: automotive This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework TODO: SSL...

Hardware Bridge Session Connector

The Hardware Bridge HWBridge is a standardized method for Metasploit to interact with Hardware Devices. This extends the normal exploit capabilities to the non-ethernet realm and enables direct hardware and alternative bus manipulations. You must have compatible bridging hardware attached to this...

Google Patches Android 'Custom Boot Mode' Vulnerability

A high-risk Android custom boot mode vulnerability was one of many bugs patched by Google as part of its January Android Security Bulletin released earlier this week. On Thursday, the IBM security team that discovered the vulnerability disclosed details about the flaw which leaves Nexus 6 and 6P...

RM Bridge - Native code usage, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application RM Bridge published at the 'play' market has multiple vulnerabilities...

Cloud Bridge: Upgrading Virtual WAN MCN from 8.1 to 9.0

An error occurred while transfer software to change management system. ret =-1, file = /tmp/CB-VW-PKG-9.0.1.31.UPG...

OpenSSL: Side channel attack on modular exponentiation

A side-channel attack was found that makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. An attacker who has the ability to control code in a thread running on the same hyper-threaded core as the victim's thread that is performing decryption, could use this flaw to...