South Korea Signs Up to Cyber Theft Pledge

On Friday the Obama administration secured its second win toward establishing a new norm in cyberspace. The Joint Fact Sheet published by the White House includes the following language: "no country should conduct or knowingly support cyber-enabled theft of intellectual property, trade secrets, o...

Two Reflected XSS Vulnerabilities in Calls to Action WordPress plugin

High-Tech Bridge Security Research Lab discovered two Cross-Site Scripting XSS vulnerabilities in a popular WordPress plugin Calls to Action. A remote attacker might be able to steal user's and administrator’s cookies, credentials and browser history, modify web page content to perform phishing...

SourceBans 1.4.11 Cross Site Scripting Vulnerability

SourceBans version 1.4.11 suffers from a cross site scripting vulnerability. Vendor: Sourcebans team Vulnerable Versions: 1.4.11 and probably prior Tested Version: 1.4.11 Advisory Publication: October 2, 2015 without technical details Vendor Notification: October 2, 2015 Public Disclosure: Octobe...

CVE-2015-3974

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

Hardcoded credentials

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

CVE-2015-3974

The CVE-2015-3974 entry concerns the EasyIO-30P-SF 32-bit controller that ships with hard-coded credentials. Affected firmware versions are before 0.5.21 and before 2.0.5.21, used across multiple OEM products. Root cause: use of a hard-coded password, enabling remote attackers to gain complete ac...

CVE-2015-3974: Undefined Security Weakness

EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe products, have a...

iTop 2.1.0-2127 Cross Site Scripting Vulnerability

iTop version 2.1.0-2127 suffers from a cross site scripting vulnerability. Product: iTop Vendor: Combodo SARL Vulnerable Versions: 2.1.0-2127 and probably prior Tested Version: 2.1.0-2127 Advisory Publication: July 29, 2015 without technical details Vendor Notification: July 29, 2015 Vendor Patch...

iTop 2.1.0-2127 Cross Site Scripting

Advisory ID: HTB23268 Product: iTop Vendor: Combodo SARL Vulnerable Versions: 2.1.0-2127 and probably prior Tested Version: 2.1.0-2127 Advisory Publication: July 29, 2015 without technical details Vendor Notification: July 29, 2015 Vendor Patch: July 30, 2015 Public Disclosure: September 23, 2015...

Let's Encrypt Issues First Cert

Let’s Encrypt, a movement to issue free and automated HTTPS certificates, today hit a major milestone when its first cert went live. The desire to encrypt web-based services has accelerated projects such as Let’s Encrypt, which was announced last November, and promised by the close of this summer...

gwinnetttech.edu XSS vulnerability

Vulnerable URL: http://www.gwinnetttech.edu/fm/search/?query=aids"%2F...

Cerb 7.0.3 Cross Site Request Forgery

Advisory ID: HTB23269 Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patch: August 14, 2015 Public Disclosure: September 2, 201...

Cerb 7.0.3 Cross Site Request Forgery Vulnerability

Cerb version 7.0.3 suffers from a cross site request forgery vulnerability. Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patc...

Cerb 7.0.3 - Cross-Site Request Forgery

Advisory ID: HTB23269 Product: Cerb Vendor: Webgroup Media LLC Vulnerable Versions: 7.0.3 and probably prior Tested Version: 7.0.3 Advisory Publication: August 12, 2015 without technical details Vendor Notification: August 12, 2015 Vendor Patch: August 14, 2015 Public Disclosure: September 2, 201...

Cross-Site Scripting (XSS) in qTranslate WordPress Plugin

Advisory ID: HTB23265 Product: qTranslate WordPress plugin Vendor: Qian Qin Vulnerable Versions: 2.5.39 and probably prior Tested Version: 2.5.39 Advisory Publication: July 1, 2015 without technical details Vendor Notification: July 1, 2015 Public Disclosure: July 29, 2015 Vulnerability Type:...

WordPress qTranslate 2.5.39 Cross Site Scripting Vulnerability

WordPress qTranslate plugin version 2.5.39 suffers from a cross site scripting vulnerability. Product: qTranslate WordPress plugin Vendor: Qian Qin Vulnerable Versions: 2.5.39 and probably prior Tested Version: 2.5.39 Advisory Publication: July 1, 2015 without technical details Vendor Notificatio...

WordPress Plugin Count Per Day 3.4 - SQL Injection

WordPress Plugin Count Per Day 3.4 - SQL Injection Advisory ID: HTB23267 Product: Count Per Day WordPress plugin Vendor: Tom Braider Vulnerable Versions: 3.4 and probably prior Tested Version: 3.4 Advisory Publication: July 1, 2015 without technical details Vendor Notification: July 1, 2015 Vendo...

Multiple XSS Vulnerabilities in Paid Memberships Pro WordPress Plugin

Advisory ID: HTB23264 Product: Paid Memberships Pro WordPress plugin Vendor: Stranger Studios Vulnerable Versions: 1.8.4.2 and probably prior Tested Version: 1.8.4.2 Advisory Publication: July 1, 2015 without technical details Vendor Notification: July 1, 2015 Vendor Patch: July 8, 2015 Public...

WordPress Count Per Day 3.4 SQL Injection Vulnerability

WordPress Count Per Day plugin version 3.4 suffers from a remote SQL injection vulnerability. Product: Count Per Day WordPress plugin Vendor: Tom Braider Vulnerable Versions: 3.4 and probably prior Tested Version: 3.4 Advisory Publication: July 1, 2015 without technical details Vendor Notificatio...

WordPress Count Per Day 3.4 SQL Injection

Advisory ID: HTB23267 Product: Count Per Day WordPress plugin Vendor: Tom Braider Vulnerable Versions: 3.4 and probably prior Tested Version: 3.4 Advisory Publication: July 1, 2015 without technical details Vendor Notification: July 1, 2015 Vendor Patch: July 1, 2015 Public Disclosure: July 22,...