Bitlocker Master Key (FVEK) Extraction

This module enumerates ways to decrypt Bitlocker volume and if a recovery key is stored locally or can be generated, dump the Bitlocker master key FVEK This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

ntp: vallen in extension fields are not validated

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash...

The first Linux ransomware 马失前蹄: encryption vulnerabilities can be compromised-the vulnerability warning-the black bar safety net

In Windows have long had ransomware（ransom ransomware, until Linux in Linux. Encoder. 1, which is the first linux ransomware. This software acts with CryptoWall And TorLocker and other infamous Trojan horse software is very similar. Hackers use ransomware cases In hack remote use of popular...

Security feature bypass

Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles password changes, which allows physically proximate attackers to bypass...

CVE-2015-6095

Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles password changes, which allows physically proximate attackers to bypass...

Jenkins 1.633 Credential Disclosure

Exploit Title: Jenkins Unauthenticated Credential Recovery Disclosure Date: 10/14/2015 Response Date: 10/14/2015 Response: "Recommend this be rejected as a vulnerability." Full report including response: http://www.th3r3p0.com/vulns/jenkins/jenkinsVuln.html Vendor Homepage: https://jenkins-ci.org...

3 6 0 secure routing P1 there is an unauthorized access vulnerability that can be read password-vulnerability warning-the black bar safety net

javascript/router/wanconfigshow. cgi, javascript/router/wanconfigset. cgi, javascript/router/logget. cgi and a cgi does not require login to access, wherein javascript/router/wanconfigshow. cgi via the post can directly access Internet setup information, including the ppoe username and password,...

IBM DataPower Gateways GatewayScript Module Information Disclosure Vulnerability

IBM DataPower Gateways is a suite of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B, and cloud workloads, which protects, integrates, and optimizes access across channels...

KLA10694 Multiple vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Microsoft Windows. Malicious users can exploit these vulnerabilities to spoof user interface, cause denial of service, gain privileges, bypass security restrictions, execute arbitrary code or obtain sensitive information. Below is a complete lis...

Linux Ransomware targeting Servers and Threatening Webmasters to Pay

Since past few years, Ransomware has emerged as one of the catastrophic malware programs that lets hacker encrypts all the contents of a victim's hard drive or/and server and demands ransom typically to be paid in Bitcoin in exchange for a key to decrypt it. Until now cyber criminals were targeti...

Code injection

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attac...

CVE-2015-7412

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attac...

LastPass Vault Decryptor

This module extracts and decrypts LastPass master login accounts and passwords, encryption keys, 2FA tokens and all the vault passwords This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' require 'sqlite...

Ubiquiti Networks Hardcoded Keys / Remote Management

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure default configuration product: various Ubiquiti Networks products vulnerable version: see Vulnerable / tested versions fixed version: none available impact: High...

Ubiquiti Networks Hardcoded Keys / Remote Management Vulnerabilities

Various Ubiquiti Networks products suffer from having hardcoded keys and also having remote management interfaces enabled that can be leveraged by these credentials. Ubiquiti Networks Hardcoded Keys / Remote Management ======================================================================= Vendor...

Free Ransomware Decryption Tool — CoinVault and Bitcryptor

Have you been infected with the insidious CoinVault or Bitcryptor ransomware? If so, there is some potentially good news for you. You may now recover your encrypted files for FREE! – Thanks to the efforts of Dutch police and antivirus maker Kaspersky Lab. Security researchers from Kaspersky Lab a...

SUSE: Security Advisory for openssl (SUSE-SU-2015:1143-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBM Maximo Asset Management Weak Encryption Vulnerability

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. A security vulnerability exists in IBM Maximo Asset Management. An attacker can exploit the vulnerability to bypass security restrictions and obtain passwords with the help of a...

Gentoo Security Advisory GLSA 201408-10

Gentoo Linux Local Security Checks GLSA 201408-10 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

DESTOON V6.0 (2015-09-16) 前台无需登入sql 注入一枚

简要描述： 看了一晚上。还好挖到了、 涉及算法非暴力，以及一些sql姿势。 通宵提交的漏洞，可能算法剖析那写的有点不清楚，那就重复看几遍 = = 写了这么多，其实我就是想求个精华 详细说明： --------------------------------------------------------------------- 1 算法剖析篇 ------------- 相比以前 索马里的海贼 大牛破解的， 最新版的算法以及做了很大的改进。 function encrypt$txt, $key = '' $key or $key = DTKEY; $rnd = random32; $t...