Hotspot Shield 6.0.3 - Unquoted Service Path Privilege Escalation

Hotspot Shield 6.0.3 - Unquoted Service Path Privilege Escalation Exploit Title: Hotspot Shield Unquoted Service Path Privilege Escalation Date: 13/10/2016 Author: Amir.ght Vendor Homepage: https://www.hotspotshield.com Software Link: https://www.hotspotshield.com/download/ version : 6.0.3 Latest...

Hotspot Shield 6.0.3 - Unquoted Service Path Privilege Escalation

Exploit Title: Hotspot Shield Unquoted Service Path Privilege Escalation Date: 13/10/2016 Author: Amir.ght Vendor Homepage: https://www.hotspotshield.com Software Link: https://www.hotspotshield.com/download/ version : 6.0.3 Latest Tested on: Windows 7 Hotspot Shield installs as a service with an...

CVE-2016-1000219

A flaw was found in Kibana's logging functionality. If custom logging output was configured in Kibana, private user data could be written to the Kibana log files. A system attacker could use this data to hijack sessions of other users when using Kibana behind some form of authentication such as...

kibana: Session hijack via stealing cookies and auth headers from log ESA-2016-04

A flaw was found in Kibana's logging functionality. If custom logging output was configured in Kibana, private user data could be written to the Kibana log files. A system attacker could use this data to hijack sessions of other users when using Kibana behind some form of authentication such as...

Hotspot Shield DLL Hijacking

Exploit Title: Hotspot Shield DLL Hijacking Exploit shcore.dll Date: 27-8-2016 Author: Amir.ght Vendor Homepage: https://www.hotspotshield.com/ Software Link: https://mydati.com/download/hss-win2/HSS-773.exe Version: Tested on:Windows 7...

JVN#45583702: Installer of PhishWall Client Internet Explorer version may insecurely load Dynamic Link Libraries

PhishWall Client Internet Explorer Version, provided by SecureBrain Corporation, is an anti-phishing and anti-MITB software. The installer of PhishWall Client Internet Explorer Version contains an issue with the DLL search path, which may lead to insecurely loading dynamic linking libraries. This...

What you need to know: Navigating EU Data Protection changes – EU-US Privacy Shield and EU General Data Protection Regulation

If youre an organization with trans-Atlantic presence that transmits and stores European citizen data e.g. employee payroll & HR data, client & prospect data in the U.S. you will want to pay attention. What we will discuss was administered under the European Unions Data Protection Directive and a...

Use CouchDB to unauthorized access vulnerability to execute arbitrary system commands-bug warning-the black bar safety net

5 on 1 6, Ali cloud shield defense against the team from external sources informed that the CouchDB database exists for unauthorized access vulnerabilities in the configuration is incorrect. After the test, the cloud shield team was the first to discover the use of the unauthorized access...

WordPress Typecho xmlrpc vulnerability-vulnerability warning-the black bar safety net

Generally we are concerned with WordPress, after all, the amount of users is huge, while the domestic Typecho as a lightweight blogging system on the concern of the people is not much. Typecho has a lot to draw on WordPress, including a compatible xmlrpc interface, and the WordPress of this...

Hotspot Shield Free VPN Proxy - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Hotspot Shield Free VPN Proxy published at the 'play' market has multiple vulnerabilities...

France Orders Facebook To Stop Tracking Non-Users or Face Fines

8th February 2016 would be considered as a cursed day in the history of Facebook. You might have known that just yesterday India bans Facebook's Free Basic Internet in the country. Now, Zuckerberg had got another bombshell in the form of a French Order from the European Data Protection Authority,...

GlassFish arbitrary file read vulnerability tracking report-bug warning-the black bar safety net

GlassFish is a tool for building Java EE applications service components. 2 0 1 5 years 1 0 months to be broke General purpose arbitrary file read vulnerability. Using this vulnerability, an attacker can read the server arbitrary file. Was informed of the vulnerability, cloud shield security team...

Comcast Xfinity home security system is exposed to serious vulnerabilities-vulnerability warning-the black bar safety net

Recently, researchers found that Comcast Xfinity home security system a security vulnerability exists, an attacker can not trigger the alarm of the premise into the user homes. Comcast（Comcast is the largest U.S. cable TV company, but also broadband Internet and IP telephony service provider...

Seemingly tasteless ESPCMS background injected, can actually be a lot of fun-vulnerability warning-the black bar safety net

Yesterday, the black bar safety net loophole platform exposes a ESPCMS of injection vulnerabilities, Ali cloud computing security attack and defense against a team of friends first time on the vulnerability to do an impact assessment. Did not think need to login to the backend before it can be...

Amazon Linux: Security Advisory (ALAS-2012-58)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dell SonicWall NetExtender Unquoted Autorun Privilege Escalation

Dell SonicWall NetExtender Unquoted Autorun Privilege Escalation Vendor Website : http://www.sonicwall.com INDEX --------------------------------------- 1. CVE 2. Background 3. Description 4. Affected Products 5. Solution 6. Credit 7. Disclosure Timeline 1. CVE...

Bug in OpenSSH Opens Linux Machines to Password Cracking Attack

A simple but highly critical vulnerability recently disclosed in the most widely used OpenSSH software allows attackers to try thousands of password login attempts per connection in a short period. OpenSSH is the most popular software widely used for secure remote access to Linux-based systems...

Elasticsearch vulnerability CVE-2015-4165

Summary: Elasticsearch versions 1.0.0 - 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are writeable by the user running the Elasticsearch process. It is possible to...

Elasticsearch 1.5.2 File Creation Vulnerability

Elasticsearch versions 1.0.0 through 1.5.2 are vulnerable to an engineered attack on other applications on the system. The snapshot API may be used indirectly to place snapshot metadata files into locations that are writeable by the user running the Elasticsearch process. It is possible to create...

Elasticsearch vulnerability CVE-2015-3337

Summary: All Elasticsearch versions prior to 1.5.2 and 1.4.5 are vulnerable to a directory traversal attack that allows an attacker to retrieve files from the server running Elasticsearch. This vulnerability is not present in the initial installation of Elasticsearch. The vulnerability is exposed...