CVE-2018-10299: Integer Overflow or Wraparound

An integer overflow in the batchTransfer function of a smart contract implementation for Beauty Ecosystem Coin BEC, the Ethereum ERC20 token used in the Beauty Chain economic system, allows attackers to accomplish an unauthorized increase of digital assets by providing two receivers arguments in...

RTA (Red Team Arsenal) - An Intelligent Scanner To Detect Security Vulnerabilities In Companies Layer 7 Assets

Red Team Arsenal is a web/network security scanner which has the capability to scan all company's online facing assets and provide an holistic security view of any security anomalies. It's a closely linked collections of security engines to conduct/simulate attacks and monitor public facing asset...

The Role That IT Security Teams Need to Play in Connected Hospitals

The WannaCry outbreak that reportedly raked in US$1B in damage costs also forced doctors to cancel scheduled appointments, among other things, brought on warranted concern over pervasive ransomware attacks that could stem from oft-overlooked components of healthcare networks—exposed medical cyber...

OCS Inventory NG ocsreports 2.4 Cross Site Scripting

Affected Products OCSInventory-ocsreports 2.4 older releases have not been tested References https://www.secuvera.de/advisories/secuvera-SA-2017-03.txt used for updates https://www.ocsinventory-ng.org/en/ocs-inventory-server-2-4-1-has-been-released/ Release announcement of OCS Inventory 2.4.1...

Intel Halts Spectre Fixes On Older Chips, Citing Limited Ecosystem Support

Intel has halted patches for an array of older chips that would protect them against the Spectre vulnerability, according to a recent microcode update. The microcode update shows that its older products – including Wolfdale, Bloomfield, Clarksfield, Gulftown, Harpertown, Jasper Forest, SoFIA 3GR,...

CVE-2018-6189

CVE-2018-6189 affects F-Secure Radar (on-premises) prior to 2018-02-15, enabling a cross-site scripting (XSS) vulnerability via the Tags parameter in the JSON body of an outbound request to /api/latest/vulnerabilityscans/tags/batch. The issue is described as a “suggested metadata tags for assets”...

How Hackers Are Leveraging Machine Learning

For business executives and internal information security specialists, it seems that every day brings a new potential risk to the company - and in the current threat environment, it isn't hard to understand this viewpoint. Sophisticated cybercriminals are continually on the lookout for the next b...

CVE-2015-3619: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! allows remote attackers to inject arbitrary web script or HTML via vectors involving a "double encode combination of firstname, lastname and company."...

Continuous Security and Compliance Monitoring for Global IT Assets

In today’s information security world, all assets everywhere must be detected, visible, protected and compliant -- all the time. It’s no longer enough to rely on “point in time” security and compliance assessments, such as scheduled weekly or monthly scans on handpicked critical servers. “You mus...

Someone Stole Almost Half a BILLION Dollars from Japanese Cryptocurrency Exchange

Coincheck, a Tokyo-based cryptocurrency exchange, has suffered what appears to be the biggest hack in the history of cryptocurrencies, losing $532 million in digital assets nearly $420 million in NEM tokens and $112 in Ripples. In 2014, Mt Gox, one of the largest bitcoin exchange at that time,...

Continuous Security & Compliance Demo Series

This series shows you how to effectively navigate security risks, new regulations and new technologies in support of a secure and compliant digital transformation. Qualys product managers walk you through the new features of Qualys Cloud Platform and Apps and show you how to get maximum leverage...

Photos in Wifi application for iOS image and video upload module directory traversal vulnerability

Photos in Wifi application for iOS is a LAN photo sharing application based on iOS platform.Select a photo or a video to upload moudle is one of the photo and video uploading modules. A directory traversal vulnerability exists in the photo and video upload module in version 1.0.1 of the Photos in...

CVE-2018-5283

The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php...

Directory traversal

The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php...

PT-2018-16864

Name of the Vulnerable Software and Affected Versions Photos in Wifi application version 1.0.1 Description The issue concerns directory traversal in the Photos in Wifi application. It is possible to exploit this via the ext parameter to access files outside the intended directory, specifically...

CVE-2018-5283: Improper Limitation of a Pathname to a Restricted Directory

The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php...

Photos in Wifi 1.0.1 iOS - Path Traversal Web Vulnerability

Document Title: =============== Photos in Wifi 1.0.1 iOS - Path Traversal Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1600 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5283 CVE-ID: ======= CVE-2018-5283 Release Date:...

Code injection

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...

CVE-2018-3814

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...

CVE-2018-3814: Unrestricted Upload of File with Dangerous Type

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...