Triangle MicroWorks DNP3 Outstation Libraries

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Triangle MicroWorks Equipment: DNP3 Outstation Libraries Vulnerability: Stacked-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could possibly allow remote...

Sherloq - An Open-Source Digital Image Forensic Toolset

An open source image forensic toolset Introduction "Forensic ImageAnalysis is the application of image science and domain expertise to interpret the content of an image and/or the image itself in legal matters. Major subdisciplines of Forensic Image Analysis with law enforcement applications...

The vulnerability of the sqlite3WindowRewrite() function in the SQLite database management system, related to insufficient handling of exception states, allows a attacker to compromise data integrity.

The vulnerability of the sqlite3WindowRewrite function in the SQLite database management system is related to improper handling of certain syntax analyzers. Exploiting this vulnerability could allow an attacker to compromise data integrity...

dalfox

Looking for the Go v2.x version? Dalfox v3 is a complete...

Apple App Store Riddled With Money-Sucking Fleeceware Apps

Researchers are warning iPhone users of fleeceware apps after finding more than 30 examples of them on Apple’s App Store. Fleeceware is jargon for apps that trick users into paying excessive fees for basic applications and functionality that is available free elsewhere. Many of these fleeceware...

Eavesarp - Analyze ARP Requests To Identify Intercommunicating Hosts And Stale Network Address Configurations (SNACs)

A reconnaissance tool that analyzes ARP requests to identify hosts that are likely communicating with one another, which is useful in those dreaded situations where LLMNR/NBNS aren't in use for name resolution. Requirements/Installation This is only gon' work on Kali or other Debian-basedLinux...

Dark_Nexus Botnet Compromises Thousands of ASUS, D-Link Routers

A new botnet has compromised hundreds of ASUS, D-Link and Dasan Zhone routers over the past three months, as well as Internet of Things IoT devices like video recorders and thermal cameras. The botnet, called darknexus based on a string it prints in its banner, uses processes similar to previous...

Unspecified Vulnerability in HCL Technologies AppScan Standard Edition

HCL Technologies AppScan Standard Edition is a suite of dynamic analysis testing tools from HCL Technologies, India, which is primarily used for web security testing. HCL Technologies AppScan Standard Edition suffers from an unspecified vulnerability that stems from an incorrect account lockout...

Memory corruption vulnerability in pdfresurrect

pdfrecurrent is a PDF document analysis tool. pdfresurrect has a memory corruption vulnerability that can be exploited by an attacker to cause a denial of service...

TAO Open Source Assessment Platform 3.3.0 RC2 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications ======================================================================= title: Multiple XSS vulnerabilities product: TAO Open Source Assessment Platform vulnerable version: 3.3.0 RC2 fixed version: - CVE number: - impact: medium homepage:...

Thinking Outside the Bochs: Code Grafting to Unpack Malware in Emulation

This blog post continues the FLARE script series with a discussion of patching IDA Pro database files IDBs to interactively emulate code. While the fastest way to analyze or unpack malware is often to run it, malware won’t always successfully execute in a VM. I use IDA Pro’s Bochs integration in...

ICSA-20-098-05_KUKA.Sim Pro

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: KUKA Equipment: Sim Pro Vulnerability: Improper Enforcement of Message Integrity During Transmission in a Communication Channel 2. RISK EVALUATION Successful exploitation of this vulnerability...

Fuji Electric V-Server Lite

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Fuji Electric Equipment: V-Server Lite Vulnerability: Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to gain elevated...

Security Bulletin: Log Analysis is vulnerable to Injection Attacks

Summary Operating system commands can be included in user input as parameters and be executed on the system which lead to injection attacks. Vulnerability Details Third Party Entry: PSIRT-ADV0018499 DESCRIPTION: Created from Advisory: ADV0018499 CVSS Base score: 8.4 CVSS Vector:...

Microsoft NET USE win10 - Insufficient Authentication Logic

Title: Microsoft NET USE win10 - Insufficient Authentication Logic Date: 2020-04-04 Author: hyp3rlinx Vendor: www.microsoft.com CVE: N/A + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

Firmware Analysis and Comparison Tool Cross-Site Scripting Vulnerability

Firmware Analysis and Comparison Tool FACT is a firmware analysis and comparison tool. A cross-site scripting vulnerability exists in Firmware Analysis and Comparison Tool FACT version 3. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An...

CVE-2020-11499

Firmware Analysis and Comparison Tool FACT 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongotaskconversion.py...

CVE-2020-11499

Firmware Analysis and Comparison Tool FACT 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongotaskconversion.py...

Cross site scripting

Firmware Analysis and Comparison Tool FACT 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongotaskconversion.py...

CVE-2020-11499

Firmware Analysis and Comparison Tool FACT 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongotaskconversion.py...