PT-2018-9453

Name of the Vulnerable Software and Affected Versions OCS Inventory NG ocsreports versions 2.3.1 through 2.4 Description The issue allows an authenticated attacker to gain full access to data stored within the database due to a SQL Injection vulnerability in the web search function. This can be...

PT-2018-9452

Name of the Vulnerable Software and Affected Versions OCS Inventory NG version ocsreports 2.4 Description The issue concerns a Cross Site Scripting XSS vulnerability in the login form and search functionality. This allows an attacker to execute arbitrary JavaScript code within a victim's browser...

QSC18 Virtual Edition: Global IT Asset Discovery, Inventory, and Management

Maintaining an IT asset inventory is essential for a strong security posture, but digital transformation has further complicated this already challenging task. “The volume and variety of assets, including cloud, virtualization, mobility and IoT, is disrupting IT, and security takes center stage,”...

QSC18 Virtual Edition – Building Security In: The Qualys Cloud Platform and Architecture

Digital transformation, driven primarily by the DevOps movement, represents a new opportunity “to redo IT from scratch, but more importantly, to redo security from scratch,” Sumedh Thakar, Qualys' Chief Product Officer, said during QSC18 Virtual Edition. Specifically, organizations can organicall...

willetthonda.financing.dealer.com XSS vulnerability

Open Bug Bounty ID: OBB-632387 Description| Value ---|--- Affected Website:| willetthonda.financing.dealer.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6...

Steam, Fire, and Paste – A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper

Summary The “Steam Inventory Helper” Chrome extension version 1.13.6 suffered from both a DOM-based Cross-site Scripting XSS and a clickjacking vulnerability. By combining these vulnerabilities it is possible to gain JavaScript code execution in the highly-privileged context of the extension's...

Steam, Fire, and Paste – A Story of UXSS via DOM-XSS & Clickjacking in Steam Inventory Helper

Summary The “Steam Inventory Helper” Chrome extension version 1.13.6 suffered from both a DOM-based Cross-site Scripting XSS and a clickjacking vulnerability. By combining these vulnerabilities it is possible to gain JavaScript code execution in the highly-privileged context of the extension’s...

10-Strike Network Inventory Explorer 8.54 - Registration Key Buffer Overflow (SEH) Exploit

Exploit for windows platform in category local exploits Exploit Title: 10-Strike Network Inventory Explorer 8.54 - 'Registration Key' Buffer Overflow SEH Exploit Author: Hashim Jawad - ihack4falafelx Vendor Homepage: https://www.10-strike.com/ Vulnerable Software:...

10-Strike Network Inventory Explorer 8.54 - Registration Key Buffer Overflow (SEH)

10-Strike Network Inventory Explorer 8.54 - Registration Key Buffer Overflow SEH...

10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow (SEH)

10-Strike Network Inventory Explorer 8.54 - Local Buffer Overflow SEH...

10-Strike Network Inventory Explorer Standard 8.54 Buffer Overflow

!/usr/bin/python ---------------------------------------------------------------------------------------------------------- Exploit Title : 10-Strike Network Inventory Explorer Standard v8.54 - Local Buffer Overflow SEH Exploit Author : Hashim Jawad - @ihack4falafel Vendor Homepage :...

GDPR Is Here:  Assess the Security Configurations of Your IT Systems

In prior installments of this GDPR compliance blog series, we’ve discussed the importance of key security practices such as IT asset inventory and vulnerability management. Today, we’ll focus on another core component for GDPR: policy compliance. As we’ve stated before, to comply with the EU’s...

Qualys Cloud Platform 2.33 New Features

This release of the Qualys Cloud Platform version 2.33 includes the release for CertView, plus updates and new features for AssetView, Cloud Agent, EC2 Connector, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. This posting has bee...

Open-AudIT Professional - 2.1.1 - Cross-Site Scripting Vulnerability

Exploit for windows platform in category web applications Exploit Title: Open-AudIT Professional 2.1.1 – Multiple Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.1.1...

Open-AudIT Community 2.2.0 - Cross-Site Scripting

Open-AudIT Community 2.2.0 - Cross-Site Scripting Exploit Title: Open-AudIT Community - 2.2.0 – Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.2.0 Category: WebApps Tested...

Open-AudIT Professional - 2.1.1 - Cross-Site Scripting

Open-AudIT Professional - 2.1.1 - Cross-Site Scripting Exploit Title: Open-AudIT Professional 2.1.1 – Multiple Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.1.1 Category:...

Open-AudIT Community 2.2.0 - Cross-Site Scripting

Exploit Title: Open-AudIT Community - 2.2.0 – Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.2.0 Category: WebApps Tested on: Win7 Professional CVE : CVE-2018-10314 1...

Mozilla Firefox integer overflow vulnerability (CNVD-2018-10242)

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. The Skia inventory in Mozilla Firefox is vulnerable to an integer overflow vulnerability. The vulnerability arises because an integer overflow check is not performed when a 32-bit integer is us...

When Preparing for GDPR, Don’t Neglect Public Cloud Security

With organizations aggressively moving workloads to public cloud platforms, such as Amazon’s AWS, Google Cloud, and Microsoft’s Azure, protecting these environments is critical for compliance with the EU's General Data Protection Regulation GDPR. These public cloud platforms are being used to pow...

Opmantek Open-AudIT Detection

Detection of Opmantek Open-AudIT. The script sends a connection request to the server and attempts to detect Opmantek Open-AudIT and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...