Critical WordPress Plugin Flaw Grants Admin Access to Any Registered Site User

Another day, another critical WordPress plugin vulnerability. The popular AMP for WP plugin, which helps WordPress sites load faster on mobile browsers, has a privilege-escalation flaw that allows WordPress site users of any level to make administrative changes to a website. The plugin, which has...

BabySploit - BabySplot Beginner Pentesting Framework

Tested on Kali Linux. Should work with all Debian based distros and other ones if you have the right packages installed BabySploit is a penetration testing framework aimed at making it easy to learn how to use bigger, more complicated frameworks like Metasploit. With a very easy to use UI and...

Reconnaissance Swiss Army Knife: ReconDog

Main Features Wizard + CLA interface Can extracts targets from STDIN piped input and act upon them All the information is extracted with APIs, no direct contact is made to the target Utilities Censys : Uses censys.io to gather massive amount of information about an IP address. NS Lookup : Does na...

Denial of Service Vulnerability in WIFI Sharing Wizard v5.0.0919

WIFI Sharing Wizard is a WIFI sharing software. WIFI Sharing Wizard v5.0.0919 suffers from a denial of service vulnerability. An attacker can exploit the vulnerability to cause a computer to blue screen, resulting in a denial of service...

Cannot connect to vCenter from PVS Console using stronger SCHANNEL Protocols, such as TLS 1.2

When running the XenDesktop Setup Wizard or the Streamed VM Wizard, and connecting to a vCenter Server that has been configured to only accept connections using TLS 1.1 or higher, the PVS Console could present an error stating that the Connection was closed. The error shown will have a text simil...

The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

GHSA-X8F7-H444-97W4 The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

Microsoft Office: Disable Opt-in Wizard on first run

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officeoptinwizard.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Disable Opt-in Wizard on first run Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...

RICOH MP 2001 Cross-Site Scripting Vulnerability

The RICOH MP 2001 is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address add area of the RICOH MP 2001, which arises from the program failing to properly validate user-submitted input. An attacker can exploit the vulnerability by sending the...

CVE-2018-9501

In the SetupWizard, there is a possible Factory Reset Protection bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1...

RICOH MP C6003 Cross-Site Scripting Vulnerability

The RICOH MP C6003 is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address addition area of the RICOH MP C6003. A remote attacker can exploit this vulnerability by sending the 'entryNameIn' parameter to the...

RICOH Aficio MP 305+ Cross-Site Scripting Vulnerability

The RICOH Aficio MP 305+ is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address add area in the RICOH Aficio MP 305+. A remote attacker can exploit this vulnerability by sending the 'entryNameIn' parameter to the...

Windows Update Cleanup (Tool) for Windows Embedded POSReady 7

Windows Update Cleanup Tool for Windows Embedded POSReady 7 Summary This update enables the Disk Cleanup wizard. After you install this update, you can use the Windows Update Cleanup option to delete Windows updates that you no longer need on Windows Embedded POSReady 7 devices. How to get this...

CVE-2018-7939

Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before VNS-L53C605B120CUSTC605D103, the versions before CAM-L03C605B143CUSTC605D008, the versions before CAM-L21C10B145, the versions before CAM-L21C185B156, the versions before CAM-L21C223B133, the versions before...

CVE-2018-7936

Mate 10 Pro Huawei smart phones with the versions before BLA-L29 8.0.0.148C432 have a Factory Reset Protection FRP bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can connect the phone with PC and send special...

Huawei Mate 10 Pro Phone FRP Security Bypass Vulnerability

Huawei Mate 10 Pro is a smartphone product of Chinese company Huawei Huawei. The Huawei Mate 10 Pro phone suffers from an FRP security bypass vulnerability, which allows an attacker to bypass the FRP functionality by turning off the boot wizard after connecting the phone with a PC and installing ...

XenDesktop Setup Wizard fails with error (UUID_INVALID)

When running the XenDesktop Setup Wizard XDSW you might receive the following error when selecting the PVS Accelerator Configuration. The error might also be shown when attempting to change the Accelerator Status of a Target Device or Enabling/Disabling the Accelerator setting on a Host Entry...

Huawei Emily-AL00A Override Vulnerability

The Huawei Emily-AL00A is a smartphone device from the Chinese company Huawei. A security vulnerability exists in Huawei Emily-AL00A version 8.1.0.106 SP2C00 and 8.1.0.107 SP5C00. An attacker can exploit the vulnerability by bypassing the FRP function and using the phone normally by performing a...

PVS config wizard failed with error " Service Start for Citrix PVS Soap Service failed. The service did not respond to start or control request in a timely fashion. (0x41d)"

While running the Configuration wizard it fails to start the network service. Event viewer shows that the soap service has terminated. Soap service is in stopped state and is not able to start the service. PVS config wizard failed with error " Service Start for Citrix PVS Soap Service failed. The...

Microsoft Windows: Prevent users from sharing files within their profile

This policy setting specifies whether users can share files within their profile. By default users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to...