McAfee Security Scan Plus Man-in-the-Middle Security Bypass Vulnerability

McAfee Security Scan Plus is a free set of diagnostic tools from McAfee USA. The product proactively checks your computer for up-to-date antivirus, firewall, and Web security software so that you always know if your computer is safe so that it is protected. A security bypass vulnerability exists ...

Petya-like ransomworm: Leveraging InsightVM and Nexpose for visibility into MS17-010

A Petya-like ransomworm struck on June 27th 2017 and spread throughout the day, affecting organizations in several European countries and the US. It is believed that the ransomworm achieved its initial infection via a compromised software update, and that it then leverages the EternalBlue and...

SSH Commands Ran With Privilege Escalation

The remote host required a privilege escalation in order to run one or more SSH commands, or a privilege escalation was forced by a plugin for one or more SSH commands. Note that this plugin only reports if 'Attempt least privilege' is enabled in the scan policy. TRUSTED...

McAfee Security Scan Plus - Remote Command Execution

McAfee Security Scan Plus - Remote Command Execution Vulnerability Summary The following advisory describes a Remote Code Execution found in McAfee Security Scan Plus. An active network attacker could launch a man-in-the-middle attack on a plaintext-HTTP response to a client to run any residing...

Target Information

Publishes the target information of the starting url as evaluated by the scan. No source data...

XML External Entity (XXE) And XML Entity Expansion (XEE)

Zendframework and ZendXml is vulnerable to XML external entity XXE And XML entity expansion XEE. These attacks are possible through the ZendXmlSecurity::scan function in ZendXml...

Ipswitch IMail Server Detection

Detection of installed version of Ipswitch IMail Server. This script check the presence of Ipswitch IMail Server from the banner. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Detection

Binary data oracleprimaverap6eppm.nbin...

Uncover Sensitive Data with the Classifier Tool

Understanding what sensitive data resides in your enterprise database is a critical step in securing your data. Imperva offers Classifier, a free data classification tool that allows you to quickly uncover sensitive data in your database. Classifier contains over 250 search rules for popular...

Bad Code Library Triggers Devil's Ivy Vulnerability in Millions of IoT Devices

Tens of millions of products ranging from airport surveillance cameras, sensors, networking equipment and IoT devices are vulnerable to a flaw that allows attackers to remotely gain control over devices or crash them. The vulnerability, dubbed Devil’s Ivy, was identified by ​researchers at Senrio...

Devil's Ivy vulnerability(CVE-2017-9765)

When we began a security analysis of remote configuration services last year, we had no idea it would lead us to uncover vulnerabilities that affect so many users. We have been studying the prevalence and nature of the vulnerabilities that arise in remote configuration services, so when we...

Oracle E-Business Suite 12.x - Server-Side Request Forgery

Exploit Title: Oracle E-Business Suite - Server Side Request Forgery Date: 19 July 2017 Exploit Author: Sarath Nair aka AceNeon13 Contact: @AceNeon13 Greetings: Raj3sh.tv, Deepu.tv Vendor Homepage: www.oracle.com Software Link:...

scan-interfax.ru XSS vulnerability

Vulnerable URL: http://www.scan-interfax.ru/Account/Logon/%3Csvg%20onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 07.09.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1576736 VIP website status:| Yes Check...

AVG AntiVirus for MacOS Information Disclosure Vulnerability

AVG AntiVirus for MacOS is an antivirus and anti-backdoor antivirus program for MacOS. scan engine is one of the antivirus scanning engines. A security vulnerability exists in versions of AVG AntiVirus for MacOS prior to scan engine 4668. A remote attacker could exploit the vulnerability to bypas...

X (Formerly Twitter): XXE on sms-be-vip.twitter.com in SXMP Processor

Hi team, What type of issue are you reporting? Does it align to a CWE or OWASP issue? I've identified an XXE vulnerability in the cloudhopper sxmp servlet on sms-be-vip.twitter.com which discloses local files to an external attacker and allows web requests to be sent. This aligns to...

CVE-2017-9977: Undefined Security Weakness

AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan inside disk image aka DMG files...

Not All Threats Are Created Equal

In today’s world, security teams are bombarded constantly with security events and threat information from multiple sources, making it impossible to address each threat with the same amount of urgency. Where does one even start? We know every threat should be addressed, but not all threats are...

PT-2017-3612

Name of the Vulnerable Software and Affected Versions: Android versions affected versions not specified Description: The issue is related to an improper buffer length calculation in the wma roam scan filter function, which leads to a buffer overflow. This can potentially allow an attacker to...

CVE-2017-10925

IrfanView 4.44 32bit with FPX Plugin 4.47 might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .fpx file, related to "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at...

Petya-like ransomworm: Leveraging InsightVM and Nexpose for visibility into MS17-010

A Petya-like ransomworm struck on June 27th 2017 and spread throughout the day, affecting organizations in several european countries and the US. It is believed that the ransomworm may achieve its initial infection via a malicious document attached to a phishing email, and then leverages the...