Authentication Port Spoofing

Apache Qpid Broker-J is vulnerable to authentication port spoofing. An attacker can use an HTTP port to trick the library into using an authentication provider which is configured for a different port number referred to as the spoofed port. This becomes a vulnerability when the spoofed port has a...

Debian DSA-4054-1 : tor - security update

Multiple vulnerabilities have been found in Tor, a connection-based low-latency anonymous communication system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4054. The text itself is...

Anonymous Muslim Group Confusing ISIS with Porn and Fake News

By Waqas A couple of weeks ago, it was reported that a group of This is a post from HackRead.com Read the original post: Anonymous Muslim Group Confusing ISIS with Porn and Fake News...

OnionShare - Securely and anonymously share a file of any size

OnionShare lets you securely and anonymously share files of any size. It works by starting a web server, making it accessible as a Tor onion service, and generating an unguessable URL to access and download the files. It doesn't require setting up a server on the internet somewhere or using a thi...

Vivotek IP Cameras - Remote Stack Overflow

Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no credentials needed Firmware Vulnerable: Only 2017 versions...

Hack of Attack-for-Hire Service vDOS Snares New Mexico Man

A New Mexico man is facing federal hacking charges for allegedly using the now defunct attack-for-hire service vDOS to launch damaging digital assaults aimed at knocking his former employer's Web site offline. Prosecutors were able to bring the case in part because vDOS got massively hacked last...

Catalyst Mahara Anonymous Comments Vulnerability

Catalyst Mahara is a social networking system from Catalyst IT in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Catalyst Mahara versions 1.9 before 1.9.7, 1.10 before 1.10.5, and 15.04 before 15.04.2. An attacker could exploit...

What is cryptocurrency and why do cybercriminals love it?

Ever pretend you know what your friends are talking about because you want to sound smart and relevant—and then trap yourself in a lie? “Wow, looks like those hackers were mining for cryptocurrency. You know what cryptocurrency is, right?” “Oh yeah, totally. Cryptocurrency. Bad stuff. You know...

Uniview - Remote Command Execution Export Config (PoC)

Uniview - Remote Command Execution Export Config PoC STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config...

Uniview - Remote Command Execution / Export Config (PoC)

STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config http://IP:PORT/cgi-bin/main-cgi?json="cmd":255,"szUserName":"","u32UserLoginHandle":-1 -tcpdump- check active capture...

IBM BigFix Platform Elevation of Privilege Vulnerability

IBM BigFix Platform formerly IBM Tivoli Endpoint Manager is a system management software. IBM BigFix Platform 9.2 and 9.5 does not perform authentication checks on critical resources or functions, which could be exploited by a remote attacker to gain access to protected areas by an anonymous user...

Authentication flaw

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862...

CVE-2017-1222

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862...

CVE-2017-1222

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862...

Brilliant Gallery - Highly critical - Multiple Vulnerabilities - SA-CONTRIB-2017-079

This module enables you to display any number of galleries based on images located in the files folder. The module doesn't sufficiently sanitize various database queries which may allow attackers to craft requests resulting in an SQL injection vulnerability. This vulnerability could be exploited...

Axis SSI - Remote Command Execution Read Files

Axis SSI - Remote Command Execution Read Files STX Subject: SSI Remote Execute and Read Files Researcher: bashis August 2016 Release date: October, 2017 Old stuff that I've forgotten, fixed Q3/2016 by Axis Attack Vector: Remote Authentication: Anonymous no credentials needed Conditions: The cam...

Contributors Summary Macro Shows Data to Anonymous Users

h2. Steps to reproduce In Global Permission, ensure Anonymous users "Can Use" Confluence Create new Space , eg: SpaceA Go To Space Tools Permissions Edit Permission Ensure Anonymous Users has "View" Permission Create a few test pages in SpaceA Then, create a page containing both Contributors Macr...

Contributors Summary Macro Shows Data to Anonymous Users

h2. Steps to reproduce In Global Permission, ensure Anonymous users "Can Use" Confluence Create new Space , eg: SpaceA Go To Space Tools Permissions Edit Permission Ensure Anonymous Users has "View" Permission Create a few test pages in SpaceA Then, create a page containing both Contributors Macr...

Windows SMB Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the default Windows SMB Server configuration which allows anonymous users to remotely access certain named pipes that are also configured to allow anonymous access to users who are logged on locally. An unauthenticated attacker who successfully...

CVE-2017-1483

IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 128621...