App Used by Israel's Ruling Party Leaked Personal Data of All 6.5 Million Voters

An election campaigning website operated by Likud―the ruling political party of Israeli Prime Minister Benjamin Netanyahu―inadvertently exposed personal information of all 6.5 million eligible Israeli voters on the Internet, just three weeks before the country is going to have a legislative...

Exchange Control Panel ViewState Deserialization

This module exploits a .NET serialization vulnerability in the Exchange Control Panel ECP web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of...

Information disclosure

An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover all previously used passwords on the device, for both the control panel and WEP/WPA/WPA2, in plaintext. This is a different issue than CVE-2012-6340...

ABB CP651 HMI Trust Management Issue Vulnerability

The ABB CP651 is a control panel from ABB Switzerland. A vulnerability exists in the ABB CP651 HMI with trust management issues. An attacker could exploit this vulnerability to insert and run arbitrary code on an affected system...

The vulnerability of the cgi-bin/index2.asp component of Genexis Platinum-P4410-V2 and Genexis Platinum-4410 routing software allows a hacker to obtain authentication data necessary to access the router administration panel.

The vulnerability of the cgi-bin/index2.asp component of Genexis Platinum-P4410-V2 and Genexis Platinum-4410 routing software is related to authentication deficiencies. Exploiting this vulnerability could allow an attacker to obtain authentication credentials necessary to access the router...

Product update: Virtuozzo Infrastructure Platform 3.5 Hotfix 1 (3.5.0-812)

This update provides stability fixes for the upgrade procedure. Vulnerability id: VSTOR-30463 MDS could crash after the upgrade to version 3.5. Vulnerability id: VSTOR-30541 Nodes could be marked as offline in the admin panel after a failed upgrade...

CVE-2020-8088

panellogin.php in UseBB 1.0.12 allows type juggling for login bypass because != is used instead of !== for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters...

KLA11535 An elevation of privilege vulnerability in Microsoft Developer Tools

An elevation of privilege vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2019-1211 Related products Microsoft-Visual-Studio CVE list CVE-2019-1211 warning KB list Solution Install necessary updates...

PT-2020-6770 · Unknown · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions cwp-e17.0.9.8.923 Description: The issue is related to the implementation of the ajax mod security.php script in CentOS Web Panel, where the archivo parameter does not properly neutralize special elements in...

CVE-2011-3612

Cross-Site Request Forgery CSRF vulnerability exists in panel.php in UseBB before 1.0.12...

ECTouch ECShop 2.7.3 SQL Injection

Exploit Title : ECTouch ECShop v2.7.3 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 22/01/2020 Vendor Homepage : ecshop.com - ectouch.cn Software Download Link : ecshop.com/download Software Affected Versions : 1.0 and 2.7.3 Tested On : Windows a...

ABB PB610 Panel Builder 600 HMIStudio Component Input Validation Error Vulnerability

ABB PB610 Panel Builder 600 is a software for designing graphical user interfaces for the CP600 control panel platform. An input validation error vulnerability exists in the HMIStudio component in ABB PB610 Panel Builder 600 version 2.8.0.424 and earlier. The vulnerability arises from a networked...

Shell Backdoor List - PHP / ASP Shell Backdoor List

What is a shell backdoor ? A backdoor shell is a malicious piece of code e.g. PHP, Python, Ruby that can be uploaded to a site to gain access to files stored on that site. Once it is uploaded, the hacker can use it to edit, delete, or download any files on the site, or upload their own. How to...

The vulnerability of the CentOS Web Panel application for managing servers arises from insufficient validation of input data. This allows a malicious individual to delete a subdomain from a user account.

The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to delete a subdomain from a user’s account remotely...

The vulnerability in the server management application CentOS Web Panel arises due to insufficient validation of input data. This allows a malicious individual to delete a user’s email account.

The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to delete the user’s email account remotely...

The vulnerability in the CentOS Web Panel server management application arises from insufficient validation of input data. This allows attackers to gain access to the DNS records associated with the user account.

The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the DNS records of the user account...

The vulnerability of the cwpsrv-xxx cookie file in the CentOS Web Panel application allows a hacker to elevate their privileges to the root level.

The vulnerability of the cwpsrv-xxx cookie file in the CentOS Web Panel application management server application is related to the unlimited download of dangerous files. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to the root level remotely...

The vulnerability in the CentOS Web Panel server management application exists due to insufficient validation of input data. This allows a malicious actor to add an email address for email redirection to a user account.

The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to add an email address for email redirection to a user account...

The vulnerability of the server management application CentOS Web Panel arises due to insufficient validation of input data. This allows a hacker to change the email password of the user account.

The vulnerability of the CentOS Web Panel server management application exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to remotely change the user’s email account password...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I'm speaking at Indiana University Bloomington on January 30, 2020. I'll be at RSA Conference 2020 in San Francisco. On Wednesday, February 26, at 2:50 PM, I'll be part of a panel on "How to Reduce Supply Chain Risk: Lessons from...