Meterpreter over SSH – MeterSSH

Meterpreter over SSH As penetration testers, it’s crucial to identify what types of attacks are detected and what’s not. After running into a recent penetration test with a next generation firewall, most analysis has shifted away from the endpoints and more towards network analysis. While there...

McAfee Next Generation Firewall GNU Bash Code Injection (SB10085) (Shellshock)

The remote host has a version of McAfee Next Generation Firewall NGFW installed that is affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables...

Cisco ASA Next-Generation Firewall GNU Bash Environment Variable Handling Command Injection (cisco-sa-20140926-bash) (Shellshock)

The remote ASA Next-Generation Firewall NGFW host is missing a security patch. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment...

CVE-2014-6735

The imagine Next bmobile aka com.conduit.app51c3c19581af465092327dd25591b224.app application 1.7.10.243 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6735

The CVE-2014-6735 entry concerns the Android app “imagine Next bmobile” (com.conduit.app_51c3c19581af465092327dd25591b224.app) version 1.7.10.243, where SSL/TLS certificate verification is not performed, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a ...

Next Gen Portfolio Manager Default.ASP Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/25195/info Next Gen Portfolio Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an...

Timesheet Next Gen 1.5.2 - Multiple SQLi

No description provided by source. Exploit Title: Timesheet Next Gen 1.5.2 Multiple SQLi Date: 02/23/12 Author: G13 Software Link: https://sourceforge.net/projects/tsheetx/ Version: 1.5.2 Category: webapps php Vulnerability The login.php page has multiple SQL injection vulnerabilities. Both the...

LiveZilla 3.1.8.3 - XSS Vulnerability

No description provided by source. Info: LiveZilla, the Next Generation Live Help / Live Chat and Live Support System connects you to your website visitors. Use LiveZilla to provide Live Chats and monitor your website visitors in real-time. Convert visitors to customers - with LiveZilla! Credits:...

AneCMS /registre/next - SQL Injection Vulnerability

No description provided by source. Exploit Title: anecms SQli Date: 23/08/2010 Author: Sweet Contact : [email protected] Software Link: anecms.com Download: anecms.com/anecms.zip Version: All Tested on: WinXp sp3 Description : anecms is an open source blog manager...

McAfee Next Generation Firewall OpenSSL Information Disclosure (SB10071) (Heartbleed)

The remote host is running a version of McAfee Next Generation Firewall NGFW that is affected by an information disclosure vulnerability due to a flaw in the OpenSSL library, commonly known as the Heartbleed bug. An attacker could potentially exploit this vulnerability repeatedly to read up to 64...

McAfee Next Generation Firewall Detection

Binary data mcafeengfwversion.nbin...

openssl: client NULL dereference crash on malformed handshake packets

The ssl3takemac function in ssl/s3both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service NULL pointer dereference and application crash via a crafted Next Protocol Negotiation record in a TLS handshake...

CVE-2014-0845

Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL...

CVE-2014-0846

Cross-site scripting XSS vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-0844

Unspecified vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to read arbitrary data via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to read arbitrary data via unknown vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Open redirect

Open redirect vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL...

CVE-2014-0846

Cross-site scripting XSS vulnerability in IBM Rational Requirements Composer 3.x before 3.0.1.6 iFix2 and 4.x before 4.0.6, and Rational DOORS Next Generation 4.x before 4.0.6, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-0846

CVE-2014-0846 affects IBM Rational Requirements Composer (RRC) and DOORS Next Generation. Vulnerable: RRC versions 3.x prior to 3.0.1.6 iFix2 and 4.x prior to 4.0.6, and DOORS Next Generation 4.x prior to 4.0.6. Issue: cross-site scripting (XSS) allowing remote authenticated users to inject arbit...