CVE-2018-1999025

A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins connects to...

CVE-2018-1999026

A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host...

CVE-2018-1999026

The CVE-2018-1999026 issue affects Jenkins TraceTronic ECU-TEST Plugin (version 2.3 and earlier). The vulnerability is a server-side request forgery (SSRF) in ATXPublisher.java that lets an attacker trigger Jenkins to send HTTP requests to a host specified by the attacker. The provided documents ...

CVE-2018-1999025

CVE-2018-1999025 describes a man-in-the-middle vulnerability in the Jenkins TraceTronic ECU-TEST Plugin (versions 2.3 and earlier). The flaw resides in the plugin’s ATXPublisher.java and ATXValidator.java, enabling an attacker to impersonate any service that Jenkins connects to. Connected sources...

CVE-2018-1999026: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an attacker-specified host...

PT-2018-15204

Name of the Vulnerable Software and Affected Versions Jenkins TraceTronic ECU-TEST Plugin versions 2.3 and earlier Description A man-in-the-middle issue exists that allows attackers to impersonate any service that Jenkins connects to. This is due to vulnerabilities in the ATXPublisher.java and...

CVE-2018-1999025: Improper Certificate Validation

A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins connects to...

PT-2018-15205

Name of the Vulnerable Software and Affected Versions Jenkins TraceTronic ECU-TEST Plugin versions 2.3 and earlier Description A server-side request forgery issue exists in the ATXPublisher.java file, allowing attackers to have the system send HTTP requests to a host specified by the attacker...

CSRF vulnerability and missing permission checks in TraceTronic ECU-TEST Plugin allowed server-side request forgery

TraceTronic ECU-TEST Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL, with the suffix /app-version-info appended. Additionally, this form validation method did not...

Securing Our Connected Car Future with Panasonic

There are few more exciting frontiers of the Internet of Things IoT than connected cars. Gartner predicts that there will be 61 million vehicles with built-in connectivity on our roads by 2020. But as we drive ever closer to a future where autonomous vehicles are a commonplace sight, we must be...

ecu.edu XSS vulnerability

Vulnerable URL: http://www.ecu.edu/cs-dhs/nursing/personnel/profile.cfm?pid=tyndalld Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 18287 VIP website status:| Yes Check ecu.edu SSL...

Bosch automotive Drivelog Connector dongle remote vulnerability analysis-vulnerability warning-the black bar safety net

In this article, we will be on the Argus research team at Bosch Drivelog Connect BOD-II adapter in the discovery of the vulnerability is discussed in detail. Note that this vulnerability would allow an attacker to by Drivelog platform to stop a running car engine. According to the Argus of the...

CVE-2016-9337

Affected product/component: Tesla Motors Model S Gateway ECU (firmware prior to 7.1 (2.36.31) with web browser enabled). Vulnerability type/root cause: Command Injection in the Gateway ECU allowing an attacker to install malicious software and send messages to the vehicle CAN bus via a compromise...

CVE-2016-9337: Improper Neutralization of Special Elements used in a Command

An issue was discovered in Tesla Motors Model S automobile, all firmware versions before version 7.1 2.36.31 with web browser functionality enabled. The vehicle's Gateway ECU is susceptible to commands that may allow an attacker to install malicious software allowing the attacker to send messages...

PT-2017-10068

Name of the Vulnerable Software and Affected Versions Tesla Motors Model S automobile versions prior to 7.1 2.36.31 Description An issue was discovered in the vehicle's Gateway ECU, which is susceptible to commands that may allow an attacker to install malicious software. This could enable the...

Auditing CAN Devices: CANSPY

A Platform for Auditing CAN Devices In the past few years, several tools have been released allowing hobbyists to connect to CAN buses found in cars. This is welcomed as the CAN protocol is becoming the backbone for embedded computers found in smartcars. Its use is now even spreading outside the...

Tesla Gateway ECU Vulnerability

OVERVIEW Tencent’s Keen Security Lab has identified a Gateway ECU vulnerability in Tesla Motors Inc.’s Tesla Model S automobile. Tesla has produced an over-the-air firmware update to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following vehic...

cimbu.cz XSS vulnerability

Vulnerable URL: http://cimbu.cz/index.php?page=ecu=6"=cze Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3966091 VIP website status:| No Check cimbu.cz SSL connection:| Grade: F...

CANToolz aka YACHT (Yet Another Car Hacking Tool) - Framework for Black-Box CAN Network Analysis

CANToolz is a framework for analysing CAN networks and devices. This tool based on different modules which can be assembled in pipe together and can be used by security researchers and automotive/OEM security testers for black-box analysis and etc. You can use this software for ECU discovery, MIT...

Black-Box CAN Network Analysis Framework: CANToolz

CANToolz is a framework forCANbus network and device analysis. This tool consist of various different modules which can be piped together and used by security researchers and automotive/OEM security testers for black-box analysis of any CANbus system. You can use this software for ECU discovery,...