CVE-2018-16195

Aterm WF1200CR and Aterm WG1200CR Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier allows an attacker on the same network segment to execute arbitrary OS commands via SOAP interface of UPnP...

Google Play Boots 85 Malicious Adware Apps

At least 85 fake apps harboring adware, disguised as game, TV, and remote control simulator apps have been removed from the Google Play app store. Researchers with Trend Micro said Tuesday that they found an active adware family in fake apps on the Google Play store that had been downloaded a...

Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie

A group of hackers has hijacked tens of thousands of Google's Chromecast streaming dongles, Google Home smart speakers and smart TVs with built-in Chromecast technology in recent weeks by exploiting a bug that's allegedly been ignored by Google for almost five years. The attackers, who go by...

HPE UCMDB Configuration Management Service Directory Traversal Vulnerability

HPE UCMDB full name Universal CMDB is a set of resource management solutions. The solution provides bottom-up functions including automatic discovery of IT infrastructure, data modeling, service mapping definition and service impact analysis, etc. Configuration Manager Service is one of the...

CVE-2018-6336

An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code...

CVE-2018-6336

The CVE-2018-6336 issue affects osquery prior to v3.2.7. A malformed Universal/Fat binary can bypass third-party code-signing checks, causing unsigned code to execute while appearing Apple-signed. This is triggered when a Fat binary’s nested Mach-O binaries aren’t fully inspected, leading third-p...

CVE-2018-6336

An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code...

CVE-2018-6336

An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code...

Code injection

An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code...

PT-2018-17486 · Facebook · Osquery

Name of the Vulnerable Software and Affected Versions: osquery versions prior to 3.2.7 Description: A maliciously crafted Universal/fat binary can evade third-party code signing checks in osquery, allowing unsigned code to execute. This occurs because the full inspection of the Universal/fat bina...

universal-fittings.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-713008 Description| Value ---|--- Affected Website:| universal-fittings.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:...

Kaspersky: URL Advisor component in KIS products family is vulnerable to Universal XSS

Summary In Microsoft Edge, URL Advisor UI is served as first-party content on every domain. So the XSS vulnerability I found in this UI automatically applies to all websites, it allows running code in the context of any domain. Description URL Advisor frame is located under...

AZL-34325 CVE-2018-20169 affecting package kernel for versions less than 5.15.148.2-2

An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to usbgetextradescriptor in drivers/usb/core/usb.c...

PT-2018-10991 · Avanti Markets · Marketcard

Name of the Vulnerable Software and Affected Versions: Avanti Markets MarketCard affected versions not specified Description: A vulnerability exists due to the lack of proper validation of the UPC bar code on the MarketCard. This could allow an unauthenticated, local attacker to access funds with...

TV B Gone Kit - New Universal Device Case

Document Title: =============== TV B Gone Kit - New Universal Device Case References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2172 Download: https://www.vulnerability-lab.com/resources/documents/TVBGoneKitSTL.zip Informativ: https://learn.adafruit.com/tv-b-gone-kit/overvie...

WordPress universal-post-manager plugin database backup information leakage vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An information disclosure vulnerability exists in the WordPress universal-post-manager plugin database backup. An attacker ca...

WordPress Universal Post Manager 1.5.0 Database Disclosure Vulnerability

WordPress Universal Post Manager plugin version 1.5.0 suffers from a database disclosure vulnerability. Exploit Title : WordPress universal-post-manager 1.5.0 Plugins Database Backup Information Disclosure Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army...

PT-2018-2862 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.19.9 Description: An issue in the Linux kernel's USB subsystem mishandles size checks during the reading of an extra descriptor, related to the usb get extra descriptor function in drivers/usb/core/usb.c. This...

USN-3822-1 linux vulnerabilities

Jim Mattson discovered that the KVM implementation in the Linux kernel mismanages the BP and OF exceptions. A local attacker in a guest virtual machine could use this to cause a denial of service guest OS crash. CVE-2016-9588 It was discovered that the generic SCSI driver in the Linux kernel did...

Atlassian Jira Authenticated Upload Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Atlassian Jira Authenticated Upload Code Execution', 'Description' = %q This module can be used to execute a payload on Atlassian Jira via the...