Magnet Networks Tesley CPVA 642 Router - Weak WPA-PSK Passphrase Algorithm

Magnet Networks Tesley CPVA 642 Router - Weak WPA-PSK Passphrase Algorithm Exploit Title: Magnet Networks – Weak WPA-PSK passphrases used in Tesley CPVA 642 Router Google Dork: Date: 01/06/2016 Author: Matt O'Connor Advisory Link: https://www.rgb.ie/magnet-broadband-weak-wpa-psk-algorithm.pdf...

iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting

Exploit for php platform in category web applications iBilling v3.7.0 Multiple Stored and Reflected Cross Site Scripting Vulnerabilities Vendor: iBilling Product web page: http://www.ibilling.io/ Affected version: 3.7.0 Summary: The features you want, the simplicity you need! Beautifully designed...

Threat Outbreak Alert RuleID23491: Email Messages Distributing Malicious Software on June 18, 2016

Medium Alert ID: 46754 First Published: 2016 June 20 15:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23491 may contain the following files: Name | Siz...

Acer Admits E-commerce Site Breached

Taiwanese electronics company Acer began sending letters to customers last week indicating that some of their sensitive financial information–credit card data included–may have been accessed over the last year or so. Customers’ names, addresses, card numbers, expiration dates, and three digit CVV...

Insider Breach: T-Mobile Czech Employee Steals and Sells 1.5 Million Users Data

T-Mobile is the latest in the list of recent high-profile data breaches, though this time the breach is not carried out by "Peace" - the Russian hacker who was behind the massive breaches in some popular social media sites including LinkedIn, MySpace, Tumblr, and VK.com. Instead, one of the...

Wordpress Premium SEO Pack 1.9.1.3 Plugin - wp_options Overwrite

Exploit for php platform in category web applications Vendor Homepage: http://aa-team.com/ Software Link: http://codecanyon.net/item/premium-seo-pack-wordpress-plugin/6109437?srank=2 Version: 1.9.1.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated customer, subscriber wpoptions overwrite Ti...

WordPress Plugin Premium SEO Pack 1.9.1.3 - wp_options Overwrite

Vendor Homepage: http://aa-team.com/ Software Link: http://codecanyon.net/item/premium-seo-pack-wordpress-plugin/6109437?srank=2 Version: 1.9.1.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated customer, subscriber wpoptions overwrite Time line: Found 05-Jun-2016, Vendor notified 05-Jun-201...

FRticket Ticket System - Persistent Cross-Site Scripting

Exploit Title: FRticket - Ticket System - Stored XSS Google Dork: if applicable Date: 11.06.2016 Exploit Author: Hamit ABİŞ Vendor Homepage: http://codecanyon.net/item/frticket-ticket-system/16539836 Version: v1 About Get the world’s most popular customer support ticket system. FRticket is...

FRticket Ticket System - Persistent Cross-Site Scripting

FRticket Ticket System - Persistent Cross-Site Scripting Exploit Title: FRticket - Ticket System - Stored XSS Google Dork: if applicable Date: 11.06.2016 Exploit Author: Hamit ABİŞ Vendor Homepage: http://codecanyon.net/item/frticket-ticket-system/16539836 Version: v1 About Get the world’s most...

WordPress Theme Uncode 1.3.1 - Arbitrary File Upload

WordPress Theme Uncode 1.3.1 - Arbitrary File Upload Vendor Homepage: Software Link: http://themeforest.net/item/uncode-creative-multiuse-wordpress-theme/13373220 Version: 1.3.0 possible 1.3.1 Tested on: Debian 8, PHP 5.6.17-3 Type: RCE, Arbirary file UPLOAD, Low Authenticated Time line: Found...

TeamViewer Denies Hack, Blames Password Reuse for Compromises

Remote support software company TeamViewer continues to contest claims this week it was hacked and instead claims that password reuse and careless user actions may have led to some of its customers’ machines being compromised. The German company has been vigilant with its stance since posting a...

The "Restrict to articles with labels" option doesn't restrict the customer portal from suggesting KB's other than those with the nominated Label

h3. Summary Currently we have the "Restrict to articles with labels", where you can specify the label for a request. When a customer is filling the summary for a request, SD will search the knowledge base for similar content from confluence pages with that label. However, the customer portal sear...

The "Restrict to articles with labels" option doesn't restrict the customer portal from suggesting KB's other than those with the nominated Label

h3. Summary Currently we have the "Restrict to articles with labels", where you can specify the label for a request. When a customer is filling the summary for a request, SD will search the knowledge base for similar content from confluence pages with that label. However, the customer portal sear...

LocalTapiola: Exploiting Secure Shell (SSH) on mobilelt.lahitapiola.fi

Issue The reporter found one SSH-server mobilelt.lahitapiola.fi in the LocalTapiola network which had some issues. The SSH-server was not patched and it was open to the internet. Fix The issue was investigated and found to be valid although outside of the bug bounty program scope. The service...

Wendy's Comes Clean On Data Breach

Fast-food chain Wendy’s disclosed it was a victim of a point-of-sale system attack that installed malware on PoS computers affecting 300 franchise restaurants. The disclosure was part the company’s first quarter 2016 SEC filings on Wednesday and is the most complete account to date of a 2015 data...

Yahoo Releases Second Wave Unsealed FISA Documents

Yahoo officially released part two of its once-secret government documents that were part of its 2007 court battle with the Foreign Intelligence Surveillance Court FISC that forced it to reveal sensitive customer data requested by the National Security Agency. This second wave of documents brings...

robotshop.com XSS vulnerability

Vulnerable URL: https://www.robotshop.com/en/customer/account/create/ Details: Description| Value ---|--- Patched:| Yes, at 13.05.2016 Latest check for patch:| 13.05.2016 10:13 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 18413 VIP website status:| Yes Check...

FreedomPop Account Hijacking Flaws Remain Unpatched

It took close to two months, but free wireless and mobile provider FreedomPop has acknowledged reports of a serious vulnerability in its service. U.K.-based researcher Paul Moore told Threatpost that FreedomPop, which has been operating in the U.K. since last September, finally responded to a bug...

access.redhat.com Cross Site Scripting

Exploit Title: access.redhat.com Reflected XSS Credential stealer Date: 01/05/2016 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.redhat.com Version: / Category: Reflected Cross Site Scripting Google dork: Tested on: RedHat access sub-domain RedHat description :...

LocalTapiola: Possibly big authorization problem in Lähitapiola´s varainhoito

Issue The reporter found a design flaw in a feature where pdf-reports are generated. Pdf-reports were generated using 19-digit random names and the names as well as the reports were persistent and accessible by all authenticated users. Fix Guessing a random 19-digit name was found to be almost...