Express-cart Arbitrary File Upload Vulnerability

express-cart is a shopping cart module for use in Node.js. An arbitrary file upload vulnerability exists in express-cart versions prior to 1.1.7. An attacker can exploit this vulnerability to gain access on a hosted device...

PT-2018-16833

Name of the Vulnerable Software and Affected Versions Norton App Lock versions prior to 1.3.0.329 Description The issue allows a bypass exploit, enabling a user to circumvent the app and prevent it from locking the device, thereby gaining device access. Recommendations For versions prior to...

CVE-2018-5242: Undefined Security Weakness

Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2018-12048

CVE-2018-12048 concerns Canon LBP7110Cw: a remote attacker can bypass Management Mode on the web interface without a PIN by abusing /checkLogin.cgi in conjunction with /portal_top.html to gain full device access. Affected product: Canon LBP7110Cw web UI; vulnerability described as an authenticati...

Canon MF210 and MF220 Override Access Vulnerability

The Canon MF210 and MF220 are both printer devices from Canon Japan. A security vulnerability exists in the web interface of the Canon MF210 and MF220. A remote attacker can use this vulnerability to bypass System Manager Mode and gain full access to the device without knowing the login page PIN...

How to configure USB Passthrough with XenServer

This article describes the method to configure USB Pass-through with XenServer...

CVE-2017-15534

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access...

Authentication flaw

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2017-15534

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access...

PT-2018-5906

Name of the Vulnerable Software and Affected Versions: Norton App Lock versions prior to 1.3.0.13 Description: The issue allows for an authentication bypass exploit. This can enable a user to kill the app, preventing it from locking the device and thereby gaining device access. Recommendations: F...

CVE-2017-15534: Improper Authentication

The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access...

CVE-2018-5455

The CVE-2018-5455 vulnerability affects Moxa OnCell G3100-HSPA Series (version 1.4 Build 16062919 and earlier). It stems from reliance on cookies without validation or integrity checking, allowing a cookie parameter consisting only of digits to be brute-forced, bypassing authentication and enabli...

The vulnerability of Microprogrammed Software for Korenix switches, related to the use of pre-installed account data, allows a perpetrator to gain access to the device.

The vulnerability of Microprogrammed Software for Korenix switches relates to the use of pre-set credentials. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the device...

Default credentials

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take complete control of a device using default admin credentials...

Receiver Warning: "A Potentially UNSAFE Connection to the Computer Has Been Initiated"

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. -Getting warning message:"A potentially UNSAFE connection to the computer has been initiated" when...

CVE-2017-12085

An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device. An attacker needs network connectivity to the Internet to trigger this vulnerability...

CVE-2017-12085: Undefined Security Weakness

An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device. An attacker needs network connectivity to the Internet to trigger this vulnerability...

kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism

The mm subsystem in the Linux kernel through 4.10.10 does not properly enforce the CONFIGSTRICTDEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte and bypass slab-allocation access restrictions via an application that opens the...

Bypassing VirtualBox Process Hardening on Windows

Posted by James Forshaw, Project Zero Processes on Windows are securable objects, which prevents one user logged into a Windows machine from compromising another user’s processes. This is a pretty important security feature, at least from the perspective of a non-administrator user. The security...

PT-2017-15320

Name of the Vulnerable Software and Affected Versions WN-AX1167GR firmware versions 3.00 and earlier Description The issue allows an attacker with device access to execute arbitrary code on the device due to the use of hardcoded credentials. Recommendations For WN-AX1167GR firmware versions 3.00...