CVE-2017-1000089

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins...

Input validation

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...

Authentication flaw

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins...

The vulnerability of the microprogramming software of Siemens SIMATIC STEP 7 (TIA Portal) arises from the incorrect file management format used for TIA project files during version updates. This allows attackers to access important information regarding configuration settings.

The vulnerability of the microprogramming software used in Siemens SIMATIC STEP 7 TIA Portal is related to the use of an incorrect file management format for TIA project files during version updates. Exploiting this vulnerability can allow a local attacker to access important configuration...

The vulnerability of the microprogramming software of Siemens SIMATIC STEP 7 (TIA Portal) arises from the improper storage of common keys in TIA project files. This allows attackers to gain access to confidential information.

The vulnerability of the microprogramming software of Siemens SIMATIC STEP 7 TIA Portal is related to the improper storage of common keys in TIA project files. Exploiting this vulnerability can allow an intruder, operating locally, to gain access to confidential information...

CVE-2017-1000108

CVE-2017-1000108 concerns the Jenkins Pipeline: Input Step Plugin. The vulnerability arises because, by default, users with Item/Read access could interact with the input step, potentially exposing sensitive workflow interactions. The issue is mitigated by changing the permission model so that on...

TeleShadow - Telegram Desktop Session Stealer (Windows)

Stealing desktop telegrams has never been so easy ! Set the email and sender details of the sender and recipient and send it to the victim after compiling. How do I use the session file? Delete everything inside folder at "C:\Users\YourName\AppData\Roaming\Telegram Desktop\tdata" Then Replace...

jenkins-plugin-pipeline-build-step: Missing check of Item/Build permission (SECURITY-433)

The jenkins-plugin-pipeline-build-step fails to check permissions correctly allowing attackers with access to it to specify the triggering of any other project in Jenkins. This potentially gives an attacker access to projects they should not have access to...

DEBIAN-CVE-2015-7225

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...

CVE-2015-7225

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password aka OTP, which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP...

Is Your Mobile Carrier Your Weakest Link?

More online services than ever now offer two-step authentication -- requiring customers to complete a login using their phone or other mobile device after supplying a username and password. But with so many services relying on your mobile for that second factor, there has never been more riding o...

CVE-2017-1000108

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead...

Awesome! WhatsApp Now Lets You Send Files of Any Format

Have you ever felt like wishing of sending any type of file immediately to your friends and office colleagues on WhatsApp directly, instead of just contacts, images or documents? Well, now you can… The latest version of WhatsApp for Android and iOS now allows users to send and receive any type of...

Barracuda WAF V360 Firmware 8.0.1.014 Support Tunnel Hijack Exploit

Barracuda WAF V360 with firmware 8.0.1.014 suffers from a support tunnel hijacking vulnerability. Title: Barracuda WAF Support Tunnel Hijack 1. Vulnerability Details Affected Vendor: Barracuda Affected Product: Web Application Firewall V360 Affected Version: Firmware v8.0.1.014 Platform: Embedded...

Eternal blue-advanced version struck--the eternal stone integrated 7 vulnerability-vulnerability warning-the black bar safety net

In WannaCry crazy spread towards the end of last week three 5.17 security researcher Miroslav Stampar（the Government of Croatia CERT members, Sqlmap one of the creators of in his build of SMB honeypot, the discovery of new worms is through SMB vulnerability propagation. Researcher Stampar honeypo...

CVE-2017-9098

ImageMagick before 7.0.5-2 and GraphicsMagick before 1.3.24 use uninitialized memory in the RLE decoder, allowing an attacker to leak sensitive information from process memory space, as demonstrated by remote attacks against ImageMagick code in a long-running server process that converts image da...

CVE-2017-6865

CVE-2017-6865 is a DoS vulnerability in Siemens PROFINET DCP handling affecting multiple Siemens products (WinCC, STEP 7/TIA Portal, PCS 7, WinAC/WinCC flexible, SCT, SINEMA, SINUMERIK, etc.). The root cause is improper input validation, where specially crafted PROFINET DCP broadcast packets on a...

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update F)

CVSS v3 6.5 ATTENTION: Exploitable from an adjacent network/low skill level to exploit. Vendor: Siemens Equipment: Devices using the PROFINET Discovery and Configuration Protocol DCP Vulnerability: Denial of Service UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory...

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update A)

CVSS v3 6.5 ATTENTION: Exploitable from an adjacent network/low skill level to exploit. Vendor: Siemens Equipment: Devices using the PROFINET Discovery and Configuration Protocol DCP Vulnerability: Denial of Service UPDATE INFORMATION This updated advisory is a follow-up to the original advisory...

Siemens devices using the PROFINET Discovery and Configuration Protocol (Update D)

CVSS v3 6.5 ATTENTION: Exploitable from an adjacent network/low skill level to exploit. Vendor: Siemens Equipment: Devices using the PROFINET Discovery and Configuration Protocol DCP Vulnerability: Denial of Service UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory...