Security Bulletin: OpenSSL vulnerabilities in IBM Algo Audit and Compliance (CVE-2016-0705, CVE-2016-0798, CVE-2016-0797, CVE-2016-0799, CVE-2016-0702)

Summary OpenSSL could allow a remote attacker to obtain sensitive information and denial of service attacks. OpenSSL is used by IBM Algo Audit and Compliance. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when...

Open-AudIT Professional Cross-Site Scripting Vulnerability

Open-AudIT Professional is a network discovery and auditing program. The program intelligently scans networks and network devices and provides status reports. A cross-site scripting vulnerability exists in Open-AudIT Professional version 2.1.1. A remote attacker can exploit this vulnerability to...

Monitoring Data & Data Access to Support Ongoing GDPR Compliance – Part III: Tools

The new European Union EU-wide General Data Protection Regulation GDPR was signed into law in late April 2016, and the compliance deadline came into effect on May 25, 2018. The Regulation is expansive and covers a variety of subject areas, provisions, and actions in the form of documented Article...

userSpice 4.3.24 - X-Forwarded-For Cross-Site Scripting

userSpice 4.3.24 - X-Forwarded-For Cross-Site Scripting Exploit Title: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting Date: 2018-06-10 Author: Dolev Farhi Vendor or Software Link: www.userspice.com Version: 4.3.24 Tested on: Ubuntu Payload will get executed when admin visits the audit...

userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting

Exploit Title: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting Date: 2018-06-10 Author: Dolev Farhi Vendor or Software Link: www.userspice.com Version: 4.3.24 Tested on: Ubuntu Payload will get executed when admin visits the audit log page !/usr/bin/perl use strict; use LWP::UserAgent;...

audit-gsc.com XSS vulnerability

Open Bug Bounty ID: OBB-629552 Description| Value ---|--- Affected Website:| audit-gsc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

XNU kernel heap overflow due to bad bounds checking in MPTCP(CVE-2018-4241)

mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: // verify salen for AFINET: if dst-safamily == AFINET && dst-salen !=...

Microsoft Windows: Override audit policy category settings with subcategory settings

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winauditsubcategoryoverwrite.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Audit: Force audit policy subcategory settings Windows Vista or later to override audit policy category settings' on Windows hosts Author...

Procps-ng - Multiple Vulnerabilities

Exploit for linux platform in category local exploits Procps-ng Audit Report ======================================================================== Contents ======================================================================== Summary 1. FUSE-backed /proc/PID/cmdline 2. Unprivileged process...

Procps-ng - Multiple Vulnerabilities

Procps-ng - Multiple Vulnerabilities Qualys Security Advisory Procps-ng Audit Report ======================================================================== Contents ======================================================================== Summary 1. FUSE-backed /proc/PID/cmdline 2. Unprivileged...

Salt-Scanner - Linux Vulnerability Scanner Based On Salt Open And Vulners Audit API

A linux vulnerability scanner based on Vulners Audit API and Salt Open, with Slack notifications and JIRA integration. Features Slack notification and report upload JIRA integration OpsGenie integration Requirements Salt Open 2016.11.x salt-master, salt-minion¹ Python 2.7 salt you may need to...

Galileo - Web Application Audit Framework

Galileo is an open source penetration testing tool for web application, which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. Installation $ git clone https://github.com/m4ll0k/Galileo.git galileo $ cd galileo Install requirements $ pip...

Chinese Hackers Find Over a Dozen Vulnerabilities in BMW Cars

Chinese security researchers have discovered more than a dozen vulnerabilities in the onboard compute units of BMW cars, some of which can be exploited remotely to compromise a vehicle. The security flaws have been discovered during a year-long security audit conducted by researchers from Keen...

Procps-ng Audit Report

Qualys Security Advisory Procps-ng Audit Report ======================================================================== Contents ======================================================================== Summary 1. FUSE-backed /proc/PID/cmdline 2. Unprivileged process hiding 3. Local Privilege...

Open-AudIT Community Cross-Site Scripting Vulnerability

Open-AudIT is a network discovery and auditing program. The program intelligently scans networks and network devices and provides status reports.Open-AudIT Community is its community version. A cross-site scripting vulnerability exists in Open-AudIT Community version 2.2.0. A remote attacker can...

Open-AudIT Community 2.2.0 Cross Site Scripting

Exploit Title: Open-AudIT Community - 2.2.0 a Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.2.0 Category: WebApps Tested on: Win7 Professional CVE : CVE-2018-10314 1...

Open-AudIT Professional 2.1.1 Cross Site Scripting

Exploit Title: Open-AudIT Professional 2.1.1 a Multiple Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.1.1 Category: WebApps Tested on: Win7 Professional CVE : CVE-2018-91...

Open-AudIT Community - 2.2.0 – Cross-Site Scripting Vulnerability

Exploit for windows platform in category web applications Exploit Title: Open-AudIT Community - 2.2.0 – Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.2.0 Category: WebApp...

Open-AudIT Professional - 2.1.1 - Cross-Site Scripting Vulnerability

Exploit for windows platform in category web applications Exploit Title: Open-AudIT Professional 2.1.1 – Multiple Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.1.1...

Open-AudIT Community 2.2.0 - Cross-Site Scripting

Open-AudIT Community 2.2.0 - Cross-Site Scripting Exploit Title: Open-AudIT Community - 2.2.0 – Cross-Site Scripting Exploit Author: Tejesh Kolisetty Vendor Homepage: https://opmantek.com/ Software Link: https://opmantek.com/network-tools-download/ Affected Version: 2.2.0 Category: WebApps Tested...