Unauthorized Access Vulnerability in AIOT Structural Health Monitoring System

Shanghai Tonglei Civil Engineering Technology Co., Ltd. is a professional technical service company dedicated to providing information technology solutions in the building structure industry. An unauthorized access vulnerability exists in the AIOT structural health monitoring system, which can be...

Social engineering. When you’re the mark…

Who am I? I am Scott, and you may have met me, if you did your recollection of me will be unique most likely. I am a social chameleon. I can be your best mate, the lost friend you never knew you lost and even an expert in things you are interested in. I live off your stories and I weave my way in...

Mitsubishi Electric FR Configurator2

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low skill level to exploit Vendor: Mitsubishi Electric Equipment: Mitsubishi Electric FR Configurator2 Vulnerabilities: Improper Restriction of XML External Entity Reference, Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitation...

Metasploit Reverse Session Takeover Vulnerability

Exploit for multiple platform in category local exploits Exploit Title: Metasploit Reverse Session Takeover Exploit Author: Social Engineering Neo - @EngineeringNeo Software Link: https://www.metasploit.com/download Version: Metasploit Pro v4.17.67-dev Tested on: Linux & Windows Metasploit Revers...

Microsoft Windows Task Scheduler Local Privilege Escalation

Microsoft Windows Task Scheduler local EoP Report by Social Engineering Neo. Affected Platforms: - Microsoft Windows ≤10 Tested On: - Windows 10 build 1809, 1903 & Windows 7 SP1. Tested on the most recent security patch. July 2019 Class: - Improper Authorization - CWE-285. Remote Code Execution...

Compromising vital infrastructure: problems in education security continue

The educational system and many of its elements are targets for cybercriminals on a regular basis. While education is a fundamental human right recognized by the United Nations, the financial means of many schools and other entities in the global educational system are often limited. These limite...

JetBlue Bomb Scare Set Off with Apple AirDrop

The feature in Apple mobile devices that allows people to send photos to nearby phones via Bluetooth is at the heart of a terrorism scare on a JetBlue flight over the weekend. According to the New York Daily News, a prankster sent a photo of a suicide vest to everyone who had an Apple device on t...

[SECURITY] Fedora 29 Update: radare2-3.6.0-1.fc29

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

CVE-2019-0975

A security feature bypass vulnerability exists when Active Directory Federation Services ADFS improperly updates its list of banned IP addresses. To exploit this vulnerability, an attacker would have to convince a victim ADFS administrator to update the list of banned IP addresses. This security...

Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

Microsoft Windows Task Scheduler suffers from a local privilege escalation vulnerability. The Windows MMC auto-elevates members of the 'administrators' group via the GUI and MMC snap-ins via mmc.exe automatically elevate without prompting UAC potentially leading to unintentional elevation of...

Dwarf - Full Featured Multi Arch/Os Debugger Built On Top Of PyQt5 And Frida

A debugger for reverse engineers, crackers and security analyst. Or you can call it damn, why are raspberries so fluffy or yet, duck warriors are rich as fuck. Whatever you like! Built on top of pyqt5, frida and some terrible code. Checkout the website for features, api and examples CHANGELOG...

Schneider Electric Interactive Graphical SCADA System

1. EXECUTIVE SUMMARY CVSS v3 7.0 Vendor: Schneider Electric Equipment: Interactive Graphical SCADA System IGSS Vulnerability: Out-of-Bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve arbitrary code execution or crash the software. 3...

OLX: Reflected XSS in www.olx.co.id

Vulnerability : Reflected XSS in www.olx.co.id Steps to Reproduce : 1 Go to https://www.olx.co.id/iklan/di-jual-t120ss-habis-kena-php-IDA4JSB.html?adtype=OR. 2 Inject this payload "alert1l43ax in adtype get parameter...

Hardcoded credentials

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a...

The null choice. A social engineering example in the wild

With social engineering there are lots of ways to get what you want, depending on the circumstance of course. The null choice is one that works really well when your desired outcome isn't obvious to the people you're trying to dupe. There are ways and means of overcoming a null choice scenario...

AndroidSecNotes

It is an offensive tool for Android. The repository contains learning notes about Android Security, specifically about the Android Runtime ART and its debugging tools. The notes cover the format of Dex files, the ART runtime, and the Hook framework. The notes mention the use of the "oatdump" tool...

ABB CP635 HMI

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable from adjacent network/low skill level to exploit Vendor: ABB Equipment: CP635 HMI Vulnerability: Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to prevent legitimate...

CISA Statement on Iranian Cybersecurity Threats

Cybersecurity and Infrastructure Security Agency CISA Director Christopher C. Krebs has released a statement in response to the recent rise in malicious cyber activity—including spear phishing and brute force attacks—by Iranian regime actors and proxies. CISA encourages users and administrators t...

PHOENIX CONTACT Automation Worx Software Suite

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Phoenix Contact Equipment: Automation Worx Software Suite Vulnerabilities: Access of Uninitialized Pointer, Out-of-bounds Read, Use After Free 2. RISK EVALUATION Successful exploitation of these...

DHS Email Phishing Scam

The Cybersecurity and Infrastructure Security Agency CISA is aware of an email phishing scam that tricks users into clicking on malicious attachments that look like legitimate Department of Homeland Security DHS notifications. The email campaign uses a spoofed email address to appear like a...