8063 matches found
ASUS RT-N10 CSRF / Code Execution / XSS / Open Redirection
Hello list! There are multiple vulnerabilities in ASUS Wireless Router RT-N10. There are Code Execution, Cross-Site Scripting and URL Redirector Abuse vulnerabilities. ------------------------- Affected products: ------------------------- Vulnerable are the next models: ASUS RT-N10, RT-N10E,...
Snowden Makes Case for a Presidential Pardon
Edward Snowden took his case to the media Wednesday arguing a presidential pardon would be an important step in preserving democracy and his only hope in returning to the United States. He argued that under the current Espionage Act, future whistleblowers would be less inclined to come forward to...
Open Redirect DDoS Tool: UFONet
Open Redirect DDoS Tool UFONet – is a tool designed to launch DDoS attacks against a target, using ‘Open Redirect’ vectors on third party web applications, like botnet. UFONet abuses OSI Layer 7-HTTP to create/manage ‘zombies’ and to conduct different attacks using; GET/POST, multithreading,...
Hacker Who Hacked Official Linux Kernel Website Arrested in Florida
Around five years after unknown hackers gained unauthorized access to multiple kernel.org servers used to maintain and distribute the Linux operating system kernel, police have arrested a South Florida computer programmer for carrying out the attack. Donald Ryan Austin, a 27-year-old programmer...
File Download Vulnerability in New Windward Technology's Online Learning Test System
New Windward Technology Online Learning Exam System is built based on enterprise-level database platform, the system architecture using a three-tier structure, B/S mode development can be used for online training and examination system. The product exists arbitrary file download vulnerability,...
Universal Serial aBUSe: USaBUSe
Universal Serial aBUSe Universal Serial aBUSe is a project released at Defcon 24 by Rogan Dawes. The team took some fairly common attacks fake keyboards in small USB devices that type nasty things and extended them to provide us with a bi-directional binary channel over our own wifi network to gi...
CVE-2016-5673
UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, which allows remote attackers to obtain open-proxy functionality by using a :: substring in between the IP address and port number...
Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl
Quick EmulatorQEMU built with the Block driver for iSCSI images support virtio-blk is vulnerable to a heap-based buffer overflow issue. The flaw could occur while processing iSCSI asynchronous I/O ioctl2 calls. A user inside a guest could exploit this flaw to crash the QEMU process resulting in...
Intel Crosswalk Man-in-the-Middle Attack Vulnerability
Intel Crosswalk is the United States Intel Intel company's set of Web engines. A man-in-the-middle attack vulnerability exists in Intel Crosswalk because the program fails to properly validate X.509 certificates. An attacker can exploit this vulnerability with a specially crafted certificate to...
foreman: Missing input validation in Smart Proxy allows RCE via TFTP file variant parameter
It was found that the “variant” parameter in the TFTP API of Foreman was passed to the eval function. An attacker could possibly use this flaw to execute arbitrary code with the privileges of the Foreman user...
Centreon 2.5.3 - Web Useralias Command Execution (Metasploit)
Exploit for python platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Centreon Web Useralias Command Execution', 'Description' = %q Centreon...
Former Cardinals Scout Christopher Correa Sentenced Four Years for Houston Astros Hack
The Federal Court came down hard on a former scouting director for the St. Louis Cardinals on Monday, sentencing Christopher Correa to almost four years in prison for hacking into a computer system that belongs to the Houston Astros. Correa, who until last summer served as Director of Baseball...
Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection
Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...
Cerber: Analyzing a Ransomware Attack Methodology To Enable Protection
Ransomware is a common method of cyber extortion for financial gain that typically involves users being unable to interact with their files, applications or systems until a ransom is paid. Accessibility of cryptocurrency such as Bitcoin has directly contributed to this ransomware model. Based on...
USN-3024-1 tomcat6, tomcat7 vulnerabilities
It was discovered that Tomcat incorrectly handled pathnames used by web applications in a getResource, getResourceAsStream, or getResourcePaths call. A remote attacker could use this issue to possibly list a parent directory . This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu...
ExpressionEngine: Filename and directory enumeration
Hello, The "Import File Converter" can be abused by an admin to map the server directories and files, because the "File location" field doesn't sanitize the user input and allows access to root directories and files. Steps to reproduce: 1- Go to...
Uber: Brute-Forcing invite codes in partners.uber.com
Hi, //We are going to use this link : https://partners.uber.com/join/?invitecode=xxxxx with GET method. There are options to customize codes, We can do it with only numbers https://partners.uber.com/join/?invitecode=1 to 10000 Or we can use some words with numbers...
UBUNTU-CVE-2016-1694
browser/browsingdata/browsingdataremover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification Authority...