Fill your Boots with credential stuffing protections

Yet again another company suffers a ‘hack’ that turns out to be nothing more than a credential stuffing attack. This time Boots have stopped customers using advantage card points to pay for products. This is after 600,000 Tesco accounts were compromised in the same way. No systems at Boots were...

Exploit for Classic Buffer Overflow in Exim

Exim RCE CVE-2018-6789 Learning Environment Description...

PT-2020-13858

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.13.13 Go versions 1.14.x prior to 1.14.5 Description The issue concerns incomplete X.509 certificate verification. Specifically, in certain conditions on Windows, the Certificate.Verify function may not check the EKU...

Multi-Juicer - Run Capture The Flags And Security Trainings With OWASP Juice Shop

Running CTFs and Security Trainings with OWASP Juice Shop is usually quite tricky, Juice Shop just isn't intended to be used by multiple users at a time. Instructing everybody how to start Juice Shop on their own machine works ok, but takes away too much valuable time. MultiJuicer gives you the...

Moxa EDS-G516E and EDS-510E Series Ethernet Switches

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Moxa Equipment: EDS-G516E series, and EDS-510E series Vulnerabilities: Stack-based Buffer Overflow, Use of a Broken or Risky Cryptographic Algorithm, Use of Hard-coded Cryptographic Key, Use of...

Moxa PT-7528 and PT-7828 Series Ethernet Switches

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Moxa Equipment: PT-7528 Series and PT-7828 Series Vulnerabilities: Stack-based Buffer Overflow, Use of a Broken or Risky Cryptographic Algorithm, Use of Hard-coded Cryptographic Key, Use of...

Attention Payment Application Developers: Begin Your Transition from the PA-DSS to the PCI SSF Today

The Payment Card Industry PCI Council plans to formally retire the Payment Application Data Security Standard PA-DSS in October 2022 and replace it with the PCI Software Security Framework SSF. For vendors, the new framework expands program eligibility with improved support for evolving...

go-toolset:ol8 security update

go-toolset 1.12.12-1 - Update for golang package fixes 1.12.12-1 - Bump version to 1.12.12 golang 1.12.12-4.0.1 - from upstream https://github.com/golang/go/issues/2775 - move arbitrary value 10% to 15% for GC tests, hits 10.48% on our - infrastructure - Resolves failing post build tests Orabug:...

CVE-2020-8841

An issue was discovered in TestLink 1.9.19. The relationtype parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection...

CVE-2020-8841: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in TestLink 1.9.19. The relationtype parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection...

PT-2020-20317

Name of the Vulnerable Software and Affected Versions TestLink version 1.9.19 Description An issue was discovered that allows for authenticated SQL Injection through the relation type parameter of the "lib/requirements/reqSearch.php" endpoint. Recommendations For TestLink version 1.9.19, avoid...

Google Invisible RECAPTCHA 3 Spoof Bypass Exploit

Exploit for multiple platform in category web applications Exploit Title: Google Invisible RECAPTCHA 3 - Spoof Bypass Vendor Homepage: https://developers.google.com/recaptcha/docs/invisible Exploit Git Repo: https://github.com/matamorphosis/Browser-Exploits/tree/master/RECAPTCHABypass Exploit...

CVE-2020-8632: Weak Password Requirements

In cloud-init through 19.4, randuserpassword in cloudinit/config/ccsetpasswords.py has a small default pwlen value, which makes it easier for attackers to guess passwords...

Washington Privacy Act welcomed by corporate and nonprofit actors

The steady parade of US data privacy legislation continued last month in Washington with the introduction of an improved bill that would grant state residents the rights to access, control, delete, and port their data, as well as opting out of data sales. The bill, called the Washington Privacy...

CVE-2020-7940: Weak Password Requirements

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking...

Threshold value is ignored (all shares are n=3)

Affected versions of this crate did not properly calculate secret shares requirements. This reduces the security of the algorithm by restricting the crate to always using a threshold value of three, rather than a configurable limit. The flaw was corrected by correctly configuring the threshold...

Evaluating Your Security Controls? Be Sure to Ask the Right Questions

Testing security controls is the only way to know if they are truly defending your organization. With many different testing frameworks and tools to choose from, you have lots of options. But what do you specifically want to know? And how are the findings relevant to the threat landscape you face...

Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware

CVE-2019-19781 This was only uploaded due to other researcher...

Upgrading your Citrix Hypervisor Windows I/O drivers to the latest major version (9.x)

You can update your Windows VMs to the latest major version of the Windows I/O drivers quickly and easily by using Windows Updates, Management Agent updates, or by installing from the latest managementagentXX.msifile available at CTX235403. These latest version of the drivers, whose version numbe...

WindowsFirewallRuleset - Windows Firewall Ruleset Powershell Scripts

About WindowsFirewallRuleset Windows firewall rulles organized into individual powershell scripts according to: 1. Rule group 2. Traffic direction 3. IP version IPv4 / IPv6 4. Further sorted according to programs and services such as for example: 2. ICMP traffic 3. Browser rules 4. rules for...