MSRT December 2016 addresses Clodaconas, which serves unsolicited ads through DNS hijacking

In this month’s Microsoft Malicious Software Removal Tool MSRT release, we continue taking down unwanted software, the pesky threats that force onto our computers things that we neither want nor need. BrowserModifier:Win32/Clodaconas, for instance, displays ads when you’re browsing the internet. ...

Cisco Content Security Management Appliance AsyncOS Software Update Server Certificate Validation Vulnerability (cisco-sa-20161207-asyncos)

A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to impersonate the update server. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a...

Cisco Security Appliances AsyncOS Software Update Server Certificate Validation Vulnerability

A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance ESA, Cisco Web Security Appliance WSA, and Cisco Content Management Security Appliance SMA could allow an unauthenticated, remote attacker to impersonate the update server. The vulnerability i...

Netcore / Netis 路由器后门

漏洞概要 2014 年 8 月末，由中国生产的一系列路由器（国内品牌名称为 Netcore ，国外品牌名称为 Netis ）被爆出含有一个严重的后门漏洞。攻击者可以通过此漏洞获取路由器 root 权限。 2014 年 12 月 28 日，微博上爆料 Netcore 的后门仍然存在（文章地址：http://www.weibo.com/p/1001603792736686871336）。 漏洞描述 Netcore 系列路由器在 /bin 目录下存在一个名为 igdmptd 的程序，此程序会监听 UDP 端口 53413 端口： 之后调用 operateloop...

ZTE SOHO ROUTERWEB_SHELL_CMD.GCH 远程命令执行漏洞

漏洞概要 2014 年 3 月 3 日，Rapid7 团队发布了中兴 F460 / F660 后门信息1，任何可以访问设备的用户都可以直接访问一个命令执行的 Web 界面，以 root 权限执行任意命令。 上述设备在中国境内被广泛应用，俗称“电信光猫”。 漏洞描述 ZTE 生产的 SOHO Router 的一些型号中，Web 根目录（/home/httpd ）下存在 /webshellcmd.gch 文件，没有任何访问控制，可以直接执行任意系统命令。 以下几点值得注意： Rapid7 于 2014 年 3 月 3 日公布此漏洞，但是根据搜索结果，此问题早在 2012...

WIMAX LX350P(WIXFMR-108) - Multiple Vulnerabilities

Exploit Title: WIMAX LX350PWIXFMR-108 - Multiple Vulnerabilities Date: ˝Friday, ˝December ˝11, ˝2015 Exploit/Vulnerability Author: Alireza Azimzadeh Milani alimp5 Vendor Homepage: http://www.greenpacket.com Version: v2.10.14-g1.5.2 Tested on: Kali-Linux I'm an ethical penetration tester and super...

WIMAX LX350P(WIXFMR-108) - Multiple Vulnerabilities

WIMAX LX350PWIXFMR-108 - Multiple Vulnerabilities Exploit Title: WIMAX LX350PWIXFMR-108 - Multiple Vulnerabilities Date: ˝Friday, ˝December ˝11, ˝2015 Exploit/Vulnerability Author: Alireza Azimzadeh Milani alimp5 Vendor Homepage: http://www.greenpacket.com Version: v2.10.14-g1.5.2 Tested on:...

WIMAX LX350P(WIXFMR-108) - Multiple Vulnerabilities

Exploit for hardware platform in category web applications Exploit Title: WIMAX LX350PWIXFMR-108 - Multiple Vulnerabilities Date: ˝Friday, ˝December ˝11, ˝2015 Exploit/Vulnerability Author: Alireza Azimzadeh Milani alimp5 Vendor Homepage: http://www.greenpacket.com Version: v2.10.14-g1.5.2 Tested...

Cisco FireSIGHT Management Center Certificate Validation Vulnerability

A vulnerability in the rule update functionality of Cisco FireSIGHT Management Center MC could allow an unauthenticated, remote attacker to manipulate the content of the rule update packages and execute arbitrary code on the system. The vulnerability is due to lack of certificate validation durin...

Network Security Testing: Evil Foca

Evil Foca is a tool for security pentesters and auditors whose purpose it is to test security in IPv4 and IPv6 data networks. The software automatically scans the networks and identifies all devices and their respective network interfaces, specifying their IPv4 and IPv6 addresses as well as the...

Evil FOCA - MITM, DoS, DNS Hijacking in IPv4 and IPv6 Penetration Testing Tool

Evil Foca is a tool for security pentesters and auditors whose purpose it is to test security in IPv4 and IPv6 data networks. The tool is capable of carrying out various attacks such as: MITM over IPv4 networks with ARP Spoofing and DHCP ACK Injection. MITM on IPv6 networks with Neighbor...

ZTE SOHO ROUTER WEB_SHELL_CMD.GCH 远程命令执行

1、漏洞概要2014 年 3 月 3 日，Rapid7 团队发布了中兴 F460 / F660 后门信息1，任何可以访问设备的用户都可以直接访问一个命令执行的 Web 界面，以 root 权限执行任意命令。上述设备在中国境内被广泛应用，俗称“电信光猫”。2.1漏洞描述ZTE 生产的 SOHO Router 的一些型号中，Web 根目录（/home/httpd ）下存在 /webshellcmd.gch 文件，没有任何访问控制，可以直接执行任意系统命令。以下几点值得注意：Rapid7 于 2014 年 3 月 3 日公布此漏洞，但是根据搜索结果，此问题早在 2012...

CellPipe 7130 Cross Site Request Forgery

CellPipe Router CSRF vulnerability Device model : CellPipe 7130 RG 5Ae. M2013 HOL Software Version: : 1.0.0.20h.HOL CWE: 352 - https://cwe.mitre.org/data/definitions/352.html CVE: CVE-2015-4586 Date: 16/06/2015 Discovered by: Dionisia Lerataki https://gr.linkedin.com/pub/dionisia-lerataki/88/18/8...

RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname Validation Request Hijacking

RubyGems contains a flaw in the apiendpoint function in remotefetcher.rb that is triggered when handling hostnames in SRV records. With a specially crafted response, a context-dependent attacker may conduct DNS hijacking attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900,...

ICBC Internet banking assistant and other security controls was traced to the presence of the“disaster-level”vulnerability-vulnerability warning-the black bar safety net

Recently, ICBC Internet banking assistant and other security controls was traced to the presence of the“disaster-level”vulnerability, the vulnerability can cause remote arbitrary code execution on the user computer, security caused great harm. Baidu security prompts the user as soon as possible o...

CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." A flaw was found in a...

Routers Vulnerable to Critical Remote Code Execution Vulnerability

A zero day vulnerability in popular household routers from D-Link and Trendnet could be exploited by attackers to run arbitrary code on devices. The flaw, which can be exploited without authentication, is present in version 1.3 of Realtek’s SDK, which figures into some brands of routers, accordin...

Operators issued a large number of routers to contain high-risk vulnerabilities, most of the“problem router”IP in China-vulnerability warning-the black bar safety net

! According to statistics, the global operators to the General Public of Internet users has issued at least 7 0 million ADSL Router, but unfortunately, these routers exist high-risk vulnerabilities, and thus is likely to cause large-scale router attacks. It is worth mentioning that most of...

Vulnerability warning: the D-Link friends of the perbadanan Router the presence of a remote command injection vulnerability-vulnerability warning-the black bar safety net

Recently security researcher at D-Link friends of the perbadanan on the router discovered a serious security vulnerability, an attacker can remotely obtain device The maximum access to the Root, and hijacking DNS settings or on the device to execute arbitrary commands. As early as last 1 1 month,...

D-Link Routers Haunted by Remote Command Injection Bug

Some D-Link routers contain a vulnerability that leaves them open to remote attacks that can give an attacker root access, allow DNS hijacking and other attacks. The vulnerability affects affects a number of D-Link’s home routers and the key details of the flaw have been made public by one of the...