1312 matches found
What’s New in InsightVM and Nexpose: Q1 2023 in Review
In Q1, our team continued to focus on driving better customer outcomes with InsightVM and Nexpose by further improving efficiency and performance. While many of these updates are under the hood, you may have started to notice faster vulnerability checks available for the recent ETRs or an upgrade...
Cinoshi A Novel Malware-as-a-Service Platform
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Cinoshi is a new MaaS platform with a toolkit including a stealer, botnet, clipper, and crypto-miner. Offering free stealer and web panel is rare. To receive real-time threat advisories, please follow...
Osprey Pump Controller 1.0.1 Authentication Bypass Credentials Modification
Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...
U.S. Dept Of Defense: HAProxy stats panel exposed externally
An exposed web panel for HAProxy running on a system allowed external access to the statistics page at port 1024, potentially exposing sensitive information...
PT-2023-5684 · Unknown · Control Web Panel
Name of the Vulnerable Software and Affected Versions: Control Web Panel versions affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. The specific flaw exists within the mysql manager module,...
Control Web Panel Unauthenticated Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'CWP login.php Unauthenticated RCE', 'Description' = %q Control Web Panel versions 'Spencer McIntyre', metasploit module...
Titan Stealer: A New Golang-Based Information Stealer Malware Emerges
A new Golang-based information stealer malware dubbed Titan Stealer is being advertised by threat actors through their Telegram channel. "The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP...
Linanto Control Web Panel (CWP) 7 < 0.9.8.1147 Command Injection (CVE-2022-44877)
The version of Linanto Control Web Panel CWP 7, a web based control panel application, installed on the remote host is prior to 0.9.8.1147. It is, therefore, affected by a command injection vulnerability in the login parameter of the login/index.php page. Note that Nessus has not tested for this...
Linanto Control Web Panel (CWP) Web Interface Detection
Binary data lintanocontrolwebpanelwebinterfacedetect.nbin...
Linanto Control Web Panel (CWP) Installed (Linux)
Binary data lintanocontrolwebpanelnixinstalled.nbin...
Design/Logic Flaw
A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects all Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 included...
Exploit for Code Injection in Paradox Ipr512_Firmware
Injection vulnerability in Paradox Security Systems IPR512 - C...
Exploit for Code Injection in Paradox Ipr512_Firmware
Injection vulnerability in Paradox Security Systems IPR512 - C...
Exploit for Code Injection in Paradox Ipr512_Firmware
Injection vulnerability in Paradox Security Systems IPR512 - C...
Exploit for Code Injection in Paradox Ipr512_Firmware
Injection vulnerability in Paradox Security Systems IPR512 - C...
Exploit for Code Injection in Paradox Ipr512_Firmware
Injection vulnerability in Paradox Security Systems IPR512 - C...
CVE-2022-47767: Hidden Functionality
A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 included. This does not exist in SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300,...
CVE-2022-47767
The CVE-2022-47767 issue affects Solar-Log Gateway devices running firmware v4.2.7 through v5.1.1, where a backdoor in the web dashboard allows remote login with super administrator privileges. The vulnerability is rooted in the gateway’s web panel security, enabling unauthenticated remote access...
PT-2023-15480 · Sl 1200 +5 · Sl 1200 +6
Name of the Vulnerable Software and Affected Versions: Solar-Log Gateway products versions v4.2.7 through v5.1.1 Description: A backdoor in Solar-Log Gateway products allows remote access via the web panel, gaining super administration privileges to the attacker. Recommendations: For Solar-Log...
Control Web Panel OS Command Injection Exploitation Increases After POC Release
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary On January 3, 2023, a security researcher published a proof-of-concept exploit for a vulnerability in Control Web Panel CWP that allows unauthenticated remote code execution. By January 6, the...