CVE-2018-7807

Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could...

Path traversal

Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could...

CVE-2018-7807

Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could...

CVE-2018-7807

CVE-2018-7807 affects Schneider Electric StruxureWare Data Center Expert (Data Center Expert) up to version 7.5.0. Affected component: ZIP upload feature via the user interface that accepts ZIP files; root cause is a ZipSlip-like path traversal in Java code, enabling an authenticated user to uplo...

CVE-2018-7807

Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could...

expert-marketplace.de XSS vulnerability

Open Bug Bounty ID: OBB-701383 Description| Value ---|--- Affected Website:| expert-marketplace.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Denial of Service Vulnerability in Jiangmin Optimization Expert 4WfpNetLimiter.sys Driver

Jiangmin Optimization Expert is a completely free computer optimization software that is purely a tool. A denial of service vulnerability exists in the JM Optimization Expert 4WfpNetLimiter.sys driver. An attacker can cause a denial of service attack by sending a 0x00222408 request using the...

SwitchVPN for macOS 2.1012.03 - Privilege Escalation

======================================================================= Title: Privilege Escalation Vulnerability Product: SwitchVPN for MacOS Vulnerable version: 2.1012.03 CVE ID: CVE-2018-18860 Impact: Critical Homepage: https://switchvpn.net/ Identified: 2018-09-29 By: Bernd Leitner...

SwitchVPN For MacOS 2.1012.03 Privilege Escalation Exploit

Exploit for macOS platform in category local exploits ======================================================================= Title: Privilege Escalation Vulnerability Product: SwitchVPN for MacOS Vulnerable version: 2.1012.03 CVE ID: CVE-2018-18860 Impact: Critical Homepage: https://switchvpn.ne...

Denial of Service Vulnerability in Jiangmin Optimization Expert WfpNetLimiter Driver

Jiangmin Optimization Expert is a completely free computer optimization software that is purely a tool. A denial of service vulnerability exists in the Jiangmin Optimization Expert WfpNetLimiter driver. An attacker can exploit the vulnerability to cause a computer to blue screen, resulting in a...

Security update for libzypp, zypper (important)

This update for libzypp, zypper, libsolv provides the following fixes: Security fixes in libzypp: - CVE-2018-7685: PackageProvider: Validate RPMs before caching bsc1091624, bsc1088705 - CVE-2017-9269: Be sure bad packages do not stay in the cache bsc1045735 Changes in libzypp: - Update to version...

Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability

OVERVIEW Independent researcher Artyom Kurbatov has identified a cleartext transmission vulnerability in Schneider Electric’s StruxureWare Building Expert product. Schneider Electric has produced a new firmware version that mitigates this vulnerability. Artyom Kurbatov has tested the new firmware...

Reddit AMA

I did a Reddit AMA on Thursday, September 6...

Google Expands Bug-Bounty Program to Battle Abuse Methods

Google is now offering rewards for newly-discovered techniques that bad actors could use to bypass its systems protecting against abuse, fraud and spam. The company has expanded its bug bounty program scope beyond security vulnerabilities to also focus on mitigations around potential abuse method...

asmbs.org XSS vulnerability

Open Bug Bounty ID: OBB-662930 Description| Value ---|--- Affected Website:| asmbs.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ZombieBoy cryptomining malware exploits CVEs to evade detection

By Waqas ZombieBoy malware makes $1,000 Monero on a monthly basis. An independent security expert James Quinn has discovered a new family of cryptominers that has been dubbed as ZombieBoy. According to Quinn’s analysis, the newly discovered cryptomining worm clocked in at 43 KH/s which means as p...

A week in security (July 16 – July 22)

Last week on Labs, we looked at a Magniber expansion, explored open source vulnerabilities, and checked out the boons and drawbacks of smart assistants. We also continued our ad blocking article extravaganza, gave a whistlestop tour of third-party problems, and published our Q2 Cybercrime tactics...

Welcome to a New Look for Threatpost

Today we’re excited to unveil a better Threatpost. The update brings a fresh new look to the site, but also gives us a better platform overall, built and designed from the ground up for the future. Our first goal was to preserve all the things that didn’t need fixing – starting with Threatpost’s...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows

Summary Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version Java 1.8.0 SR4 FP1 used by DB2 Recovery Expert for Linux, Unix and Windows. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017. Vulnerability Details CVEID: CVE-2017-10115...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect DB2 Recovery Expert for Linux, Unix and Windows

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version Java 1.8.0 SR1 FP10 used by DB2 Recovery Expert for Linux, Unix and Windows. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details CVEID: CVE-2016-5546 DESCRIPTION: An...