Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics (CVE-2015-4872, CVE-2015-4734, CVE-2015-5006, CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 1.6 and 1.7 that is used by IBM SPSS Statistics. These issues were disclosed as part of the IBM Java SDK updates in October 2015 and includes the vulnerability commonly referred to as “SLOTH”...

Security Bulletin: DH Key Exchange protocol vulnerability (“Logjam”) affects SPSS Data Access Pack

Summary TLS connections using Diffie-Hellman DH key exchange protocol affects IBM SPSS Data Accesss Pack 7.1.1. This attack has been referred to as "Logjam" in various sources. IBM SPSS Data Access Pack is a software component used by IBM SPSS Statistics and IBM SPSS Modeler. Vulnerability Detail...

Security Bulletin: DH key exchange protocol vulnerability (“Logjam”) in IBM Java SDK affects IBM SPSS Statistics (CVE-2015-4000)

Summary TLS connections using Diffie-Hellman DH key exchange protocol, “Logjam” attack, affects IBM Java SDK 1.6, 1.7 that is used by IBM SPSS Statistics. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused...

PvPGN Stats SQL Injection Vulnerability

PvPGN Stats is a PHP-based tool that supports the integration of websites with the PvPGN game server, displaying server status, ladder pages, and more. A SQL injection vulnerability exists in the ladder/stats.php file in PvPGN Stats version 2.4.6, which stems from the program failing to filter...

CVE-2017-18290

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sortdirection parameter...

WordPress Feed-Statistics Plugin Open Redirect Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL.Feed-Statistics is one of the editorial statistics through the Feed reader about the people who are readi...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15879)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the getstoragegroupstatistics method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker can exploit this vulnerability to execute system commands via the...

Malware in the age of IoT

Now that technology providers are bringing connectivity to a whole host of different items and appliances, the full force of the Internet of Things is beginning to be felt by businesses and consumers alike. From simple items like home routers to more complex, machine-to-machine systems, the IoT i...

MyBB ChangUonDyU Advanced Statistics Plugin Cross-Site Scripting Vulnerability

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL.ChangUonDyU Advanced Statistics plugin is used in one of the forum plugin. A cross-site scripting vulnerability exists in version 1.0.2 of the MyBB ChangUonDyU Advanced Statistics plugin. A...

Design/Logic Flaw

product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download...

Cross site scripting

An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field...

CVE-2018-11532

An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field...

CVE-2018-11532

An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field...

MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB ChangUonDyU Advanced Statistics Plugin v1.0.2 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1125 Version: 1.0.2 Tested on: Ubun...

MyBB ChangUonDyU 1.0.2 Cross Site Scripting

Exploit Title: MyBB ChangUonDyU Advanced Statistics Plugin v1.0.2 - Cross-Site Scripting Date: 5/25/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1125 Version: 1.0.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-11532 1...

MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting

Exploit Title: MyBB ChangUonDyU Advanced Statistics Plugin v1.0.2 - Cross-Site Scripting Date: 5/25/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=1125 Version: 1.0.2 Tested on: Ubuntu 18.04 CVE: CVE-2018-11532 1...

SKT LTE Wi-Fi SDT-CW3B1 Unauthorized Admin Credential Change

Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Date: 2018-05-23 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on: Windows CVE: - Class: Unauthorized Admin Credential Change...

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Vulnerability

Exploit for hardware platform in category web applications Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on: Windows CVE: - Class...

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Date: 2018-05-23 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on:...

SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change

Exploit Title: SKT LTE Wi-Fi SDT-CW3B1 - Unauthorized Admin Credential Change Shodan Dork: SDT-CW3B1 Date: 2018-05-23 Exploit Author: Safak Aslan Vendor Homepage: http://telesquare.co.kr/ Version: SKT CW3B1 sw version 1.2.0 Tested on: Windows CVE: - Class: Unauthorized Admin Credential Change...