django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2016-0740 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2016-0740 Source advisory: OSV:GHSA-HGGX-3H72-49WW...

Banana PI Lamobo R1 SD v3 - New Universal Router Case

Document Title: =============== Banana PI Lamobo R1 SD v3 - New Universal Router Case References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2140 Download: https://www.vulnerability-lab.com/resources/documents/2140.rar Vulnerability Magazine:...

SMPlayer 18.6.0 - Memory Corruption (DoS) Vulnerability

Document Title: =============== SMPlayer 18.6.0 - Memory Corruption DoS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2138 Release Date: ============= 2018-07-23 Vulnerability Laboratory ID VL-ID: ==================================== 213...

HomeAdvisor Pro - (EntityHash) Auth Bypass Vulnerability

Document Title: =============== HomeAdvisor Pro - EntityHash Auth Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/customer/getcontent.php?id=1929 Video: https://www.youtube.com/watch?v=PQsCIOyESIo Advisory: https://www.vulnerability-lab.com/getcontent.php?id=1557...

BMW - (Token) Cross Site Scripting Web Vulnerability

Document Title: =============== BMW - Token Cross Site Scripting Web Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1914 Video: https://www.youtube.com/watch?v=txjW7fpMJ-Q Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1737 Vulnerability...

Shopify - Persistent XML Cross Site Scripting Vulnerability

Document Title: =============== Shopify - Persistent XML Cross Site Scripting Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1983 Video: https://www.youtube.com/watch?v=LDiXveqQ0gg Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID:...

WAGO e!DISPLAY 7300T - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Remote code execution via multiple attack vectors product: WAGO e!DISPLAY 7300T - WP 4.3 480x272 PIO1 vulnerable version: FW 01 - 01.01.1001 fixed version: FW 02 CVE...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2016-9190 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2016-9190 Source advisory: OSV:GHSA-W4VG-RF63-F3J3...

Magento - Proof of Concept SSRF & XSPA Vulnerability

Document Title: =============== Magento - Proof of Concept SSRF & XSPA Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1632 Video: https://www.youtube.com/watch?v=Z2jKGQa52kA Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1631 Release Date:...

Magento - Proof of Concept SSRF & XSPA Vulnerability

Document Title: =============== Magento - Proof of Concept SSRF & XSPA Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1632 Video: https://www.youtube.com/watch?v=Z2jKGQa52kA Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1631 Release Date:...

PayPal (Notify) - Filter Bypass & Persistent Vulnerability

Document Title: =============== PayPal Notify - Filter Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1425 Video: https://www.youtube.com/watch?v=J2upim5MrV0 Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1640 Release Dat...

Ransomware and malicious crypto miners in 2016-2018

Ransomware is not an unfamiliar threat. For the last few years it has been affecting the world of cybersecurity, infecting and blocking access to various devices or files and requiring users to pay a ransom usually in Bitcoins or another widely used e-currency, if they want to regain access to...

Ecessa Edge EV150 10.7.4 CSRF Add Superuser Exploit

Summary Internet Failover and Load Balancing for Small Businesses, Stores and Branch Offices. Description The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain...

Ecessa WANWorx WVR-30 10.7.4 CSRF Add Superuser Exploit

Summary Ecessa's WANworX SD-WAN solutions increase network performance and reliability by leveraging any connection. That can be premium priced MPLS, lower cost broadband, or cellular 4G or LTE. Many of today's WAN deployments are based on older technology that was acceptable when businesses did...

Ecessa ShieldLink SL175EHQ 10.7.4 CSRF Add Superuser Exploit

Summary Ecessa's ShieldLink 60, 175, 600,1200 & 4000 are advanced, yet highly affordable secure WAN Optimization Controllers that incorporate all of the ISP/WAN link. Description The application interface allows users to perform certain actions via HTTP requests without performing any validity...

ReleaseWire - (Groups) Persistent Cross Site Vulnerability

Document Title: =============== ReleaseWire - Groups Persistent Cross Site Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2128 View Video: https://www.youtube.com/watch?v=LFZXKzkmmxA Release Date: ============= 2018-06-18 Vulnerability Laboratory ID VL-I...

Chinese hackers attack National Data Center using watering hole attack

By Waqas The IT security researchers at Kaspersky Lab have published a This is a post from HackRead.com Read the original post: Chinese hackers attack National Data Center using watering hole attack...

Stable Channel Update for Desktop

The stable channel has been updated to 67.0.3396.87 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictio...

Shopify - (Link Return) Client Side Web Vulnerability

Document Title: =============== Shopify - Link Return Client Side Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1550 Release Date: ============= 2018-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 1550...

Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway Privilege Escalation

Summary RSLinx Classic is a software platform that allows Logix5000 Programmable Automation Controllers to connect to a wide variety of Rockwell Software applications, and FactoryTalk Linx Gateway is a software that provides an Open Platform Communications OPC Unified Architecture UA server...