Inim Electronics Smartliving SmartLAN 6.x - Remote Command Execution Exploit

Exploit for hardware platform in category web applications Exploit Title: Inim Electronics Smartliving SmartLAN 6.x - Remote Command Execution Author: LiquidWorm Product web page: https://www.inim.biz Link:...

EulerOS 2.0 SP2 : openldap (EulerOS-SA-2019-2358)

According to the versions of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security...

PT-2019-15878 · Lever +1 · Lever Pdf Embedder +1

Name of the Vulnerable Software and Affected Versions: The Lever PDF Embedder plugin version 4.4 for WordPress Description: The issue concerns the distribution of polyglot PDF documents that are valid JAR archives. However, it has been argued that the plugin itself does not control the file uploa...

You’re In Safe Hands with Trend Micro Home Network Security

A three-part series on using Home Network Security to protect your home Your home should be a haven that protects you. In the cyber age, however, your router, computers, and TVs, your game consoles and smart devices, are continuously connected to the internet and run the risk of being...

Reliable Controls LicenseManager Code Issue Vulnerability

RC-LicenseManager is a credential manager. A code issue vulnerability exists in Reliable Controls LicenseManager. The vulnerability arises from an issue with improper design during code development for a networked system or product. An attacker could use this vulnerability to insert malicious cod...

Analysing the Attack Surface of an Industrial Data Acquisition Device

Introduction The Data Station Plus from Red Lion Controls was handed to me to analyse the attack surface. The device is designed to connect to SCADA data acquisition devices over Modbus, Profibus, etc. by Serial or Ethernet connection. Data is collected and recorded to a local compact flash card...

Reliable Controls LicenseManager CVE-2019-18245 Local Code Execution Vulnerability

Description Reliable Controls LicenseManager is prone to a local code execution vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will likely cause a denial-of-service condition. Reliable Controls...

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

It was found that Wildfly users had default user permissions set incorrectly. A malicious user could use this flaw to access unauthorized controls for the application server...

Google Android Media Framework Multiple Remote Code Execution Vulnerabilities

Description Google Android is prone to multiple remote code-execution vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of a privileged process. Failed attacks may cause a denial-of-service condition. These issues are being tracked by Android Bug IDs...

Google Android Framework Component Multiple Security Vulnerabilities

Description Google Android is prone to the following security vulnerabilities: 1. A denial-of-service vulnerability 2. Multiple privilege-escalation vulnerabilities 3. An information-disclosure vulnerability An attacker can exploit these issues to gain elevated privileges, obtain sensitive...

Google Android System Component Multiple Security Vulnerabilities

Description Google Android is prone to multiple security vulnerabilities. An attacker can leverage these issues to obtain sensitive information or gain elevated privileges. Failed attacks may cause a denial-of-service condition. These issues are being tracked by Android IDs A-133258003 and...

TrickBot Evolves to Go After SSH Keys

The TrickBot info-stealing malware has updated its password grabber to target data from OpenSSH and OpenVPN applications. OpenSSH is a connectivity tool for remote login with the SSH protocol; it encrypts all traffic to eliminate eavesdropping. OpenVPN meanwhile is used for secure private...

Policy Compliance Library Updates, November 2019

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

CVE-2019-18374

Symantec Critical System Protection CSP, versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing authentication controls...

httpd: mod_auth_digest: access control bypass due to race condition

A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions...

SolarWinds Orion NPM OrionModuleEngine Remote Code Execution (CVE-2019-8917)

A remote code execution vulnerability exists in SolarWinds Orion NPM. This vulnerability is due to missing access controls in the InvokeActionMethod method. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

MGASA-2019-0330 Updated systemd packages fix security vulnerability

Updated systemd packages fix security vulnerability: Nadav Markus from Palo Alto Networks discovered that systemd-resolved does not enforce appropriate access controls on its D-Bus interface and allows unprivileged users to execute methods that are meant to be available only to privileged users...

Google Android Camera CVE-2019-2234 Multiple Security Bypass Vulnerabilities

Description Google Android is prone to multiple security-bypass vulnerabilities. An attacker can exploit these issues to bypass certain security restrictions and perform unauthorized actions, or gain access to sensitive information; this may lead to further attacks. Technologies Affected Google...

Stripo Inc: Able to download any hosted content on AWS S3 bucket(stripo)

An AWS s3 bucket was found, with improper access controls, where all its contents could be downloaded. Steps to reproduce: 1. List contents of the bucket with: aws s3 ls s3://stripo 2. Download the hosted data with : aws s3 sync s3://stripo . Impact Any hosted data can be downloaded to an attacke...

Google's Plan to Crunch Health Data on Millions of Patients Draws Fire

Tech behemoth Google is using artificial intelligence to reportedly slice and dice personal healthcare details on millions of Americans. That has some researchers diagnosing the company with HIPAA violations and prescribing regulatory controls as a remedy. And, at least one federal regulator is...