IObit Advanced SystemCare 10.0.2 Privilege Escalation

Exploit Title: IObit Advanced SystemCare Unquoted Service Path Privilege Escalation Date: 19/10/2016 Author: Ashiyane Digital Security Team Vendor Homepage: http://www.iobit.com/en/index.php Software Link: http://www.iobit.com/en/advancedsystemcarefree.php version : 10.0.2 Latest Tested on: Windo...

IObit Advanced SystemCare 10.0.2 - Unquoted Service Path Privilege Escalation

Exploit Title: IObit Advanced SystemCare Unquoted Service Path Privilege Escalation Date: 19/10/2016 Author: Ashiyane Digital Security Team Vendor Homepage: http://www.iobit.com/en/index.php Software Link: http://www.iobit.com/en/advancedsystemcarefree.php version : 10.0.2 Latest Tested on: Windo...

openssl: Padding oracle in AES-NI CBC MAC check

It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when the connection used the AES CBC cipher suite and the server supported AES-NI. A remote attacker could possibly use this flaw to retrieve plain text from encrypted packets by...

IBM Multi-Enterprise Integration Gateway and B2B Advanced Communications Cross-Site Scripting Vulnerability

IBM Multi-Enterprise Integration Gateway MEIG and IBM B2B Advanced Communications are both products of IBM Corporation, U.S.A. IBM MEIG is a cross-enterprise integration communications gateway product.IBM B2B Advanced IBM MEIG is a cross-enterprise integrated communications gateway product.IBM B2...

CVE-2016-5901

Cross-site scripting XSS vulnerability in a test page in IBM Business Process Manager Advanced 8.5.6.0 through 8.5.7.0 before cumulative fix 2016.09 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-5892

Cross-site scripting XSS vulnerability in IBM 10x, as used in Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications before 1.0.0.52, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-5892

The CVE-2016-5892 XSS vulnerability affects IBM 10x used in Multi-Enterprise Integration Gateway (MEIG) 1.x up to 1.0.0.1 and IBM B2B Advanced Communications up to 1.0.0.5_1/1.0.0.5_2. The root cause is cross‑site scripting in the Web UI, potentially enabling credential disclosure within a truste...

FortiAnalyzer and FortiManager stored XSS vulnerability in report filters

A cross-site-scripting vulnerablity in FortiAnalyzer/FortiManager in advanced settings page could allow an administrator to inject scripts in the add filter field...

putlocker.is XSS vulnerability

Vulnerable URL: http://putlocker.is/search/advancedsearch.php?q=1=1=western=0from=yearto=yearsearch=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%27XSSPOSED%27%3E=1 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 230 VIP...

Vendetta Brothers, Inc. – A Window Into the Business of the Cybercriminal Underground

FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the “Vendetta Brothers.” This enterprising duo uses various strategies to compromise point-of-sale systems, steal payment card information and sell it on their underground marketplace “Vendetta World.” The...

Vendetta Brothers, Inc. – A Window Into the Business of the Cybercriminal Underground

FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the “Vendetta Brothers.” This enterprising duo uses various strategies to compromise point-of-sale systems, steal payment card information and sell it on their underground marketplace “Vendetta World.” The...

Memory Corruption Vulnerability in Multiple Symantec Products

Symantec Advanced Threat Protection: Network ATP and others are security products from Symantec, a suite of software that mines and removes advanced threats from endpoints, networks, and email gateways; Symantec Endpoint Protection SEP, a suite of antivirus software; and Symantec Endpoint...

putlocker.is XSS vulnerability

Vulnerable URL: http://putlocker.is/search/advancedsearch.php?section=0=this=is"'/;a=eval;b=alert;ab/XSSPOSED/;...

Cisco EPC 3925 XSS / CSRF / HTTP Response Injection / DoS

Title: Cisco EPC 3925 Multiple Vulnerabilities Vendor: http://www.cisco.com/ Vulnerable Versions: Cisco EPC3925 EuroDocsis 3.0 2-PORT Voice Gateway Date: 15.09.2016 Author: Patryk Bogdan ======== Vulnerability list: 1. HTTP Response Injection via 'Lang' Cookie 2. DoS via 'Lang' Cookie 3. DoS in...

Cisco EPC 3925 - Multiple Vulnerabilities

Exploit for asp platform in category web applications Title: Cisco EPC 3925 Multiple Vulnerabilities Vendor: http://www.cisco.com/ Vulnerable Versions: Cisco EPC3925 EuroDocsis 3.0 2-PORT Voice Gateway Date: 15.09.2016 Author: Patryk Bogdan ======== Vulnerability list: 1. HTTP Response Injection...

SA131 : TCP Session Hijacking in Operating Systems Supporting RFC 5961

SUMMARY Blue Coat products that include a vulnerable version of an operating system that supports RFC 5961 are susceptible to a TCP session hijacking vulnerability. A remote, off-path attacker can infer the sequence numbers of an existing TCP connection, and either reset the connection or inject...

CVE-2016-4381

HPE XP7 Command View Advanced Edition CVAE Suite 6.x through 8.x before 8.4.1-02, when Replication Manager RepMgr and Device Manager DevMgr are enabled, allows local users to bypass intended access restrictions via unspecified vectors...

Design/Logic Flaw

HPE XP7 Command View Advanced Edition CVAE Suite 6.x through 8.x before 8.4.1-02, when Replication Manager RepMgr and Device Manager DevMgr are enabled, allows local users to bypass intended access restrictions via unspecified vectors...

CVE-2016-4378

The 1 Device Manager, 2 Tiered Storage Manager, 3 Replication Manager, 4 Replication Monitor, and 5 Hitachi Automation Director HAD components in HPE XP P9000 Command View Advanced Edition Software before 8.4.1-00 and XP7 Command View Advanced Edition Suite before 8.4.1-00 allow remote attackers ...

Design/Logic Flaw

The 1 Device Manager, 2 Tiered Storage Manager, 3 Replication Manager, 4 Replication Monitor, and 5 Hitachi Automation Director HAD components in HPE XP P9000 Command View Advanced Edition Software before 8.4.1-00 and XP7 Command View Advanced Edition Suite before 8.4.1-00 allow remote attackers ...