FireEye Appliance Unauthorized File Disclosure Vulnerability

Exploit for php platform in category web applications Just one of many handfuls of FireEye / Mandiant 0day. Been sitting on this for more than 18 months with no fix from those security "experts" at FireEye. Pretty sure Mandiant staff coded this and other bugs into the products. Even more sad,...

SQL Injection Vulnerability in Enterprise Intelligence's Network Office Management Expert System

Network Office Management Expert System is a network office system with a great deal of specialized knowledge. A SQL injection vulnerability exists in the Network Office Management Specialist System, which is owned by Enterprise Intelligence. It allows attackers to exploit the vulnerability to ga...

British-born ISIS Hacker Killed in US Drone Strike in Syria

Remember Team Poison? The hackers group that was active in 2012, and was known for gaining access to the former Prime Minister Tony Blair's address book and then publishing information from it. The British hacker who actually obtained the Prime Minister's address book and was jailed for six month...

Linux x86 /bin/sh ROT7 Encoded Shellcode

Linux x86 /bin/sh ROT7 Encoded Shellcode. Shellcode exploit for linx86 platform Shellcode Title: ROT7 Date: 5 July 2015 Exploit Author: Artem Tsvetkov Software Link: https://github.com/adeptex/SLAE/tree/master/Assignment-6/rot7 Tested on: Kali GNU/Linux 1.1.0 Platform: x86 Linux This code was...

Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability

OVERVIEW Independent researcher Artyom Kurbatov has identified a cleartext transmission vulnerability in Schneider Electric’s StruxureWare Building Expert product. Schneider Electric has produced a new firmware version that mitigates this vulnerability. Artyom Kurbatov has tested the new firmware...

Open Smart Grid Protocol Alliance Plan to Fix its Weak Crypto

The Open Smart Grid Protocol Alliance, which recently came under fire for a weak crypto implementation in its protocol, will upgrade existing devices, likely starting in September. Harry Crijns, secretary of the OSGP Alliance in The Netherlands, said fixes have been developed and are “under a...

CSRF to add admin user Vulnerability In Manage Engine Device Expert

=============================================================================== CSRF to add admin user Vulnerability In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title : CSRF to add...

Manage Engine Device Expert 5.9.9.0 Cross Site Scripting

=============================================================================== Reflected XSS Vulnerability in XSS In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title :Reflected XSS...

Manage Engine Device Expert 5.9.9.0 Cross Site Scripting

=============================================================================== Stored XSS Vulnerability In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title :Stored XSS Vulnerability I...

Manage Engine Device Expert 5.9.9.0 CSRF

=============================================================================== CSRF to add admin user Vulnerability In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title : CSRF to add...

Peerio — End-to-End Encrypted Secure Messenger and File Sharing App

On one end, where governments of countries like U.K is criticizing end-to-end encryption and considering to ban the encrypted communication apps like Snapchat, CryptoCat, WhatsApp and Apple’s iMessage. On the other hand, the Internet community has come up with a new and rather more secure encrypt...

Schneider Electric StruxureWare SCADA Expert ClearSCADA Parsing Vulnerability

OVERVIEW Andrew Brooks identified and reported to The Zero Day Initiative ZDI a File Parsing Vulnerability: Schneider Electric StruxureWare SCADA Expert ClearSCADA ServerMain.exe OPF File Parsing Vulnerability. Schneider Electric has prepared workarounds and helped develop security upgrades for a...

Law Firm - Forensics Services

As cyber threats and attacks have increased year over year, Coalfire has seen a drastic increased need for support to law firms in cybersecurity cases. Attacks and threats vary so often, many law firms lack the skills required to properly evaluate cyber-attacks involving their clients. As such la...

Schneider Electric Floating License Manager Vulnerability

OVERVIEW Schneider Electric had become aware of an “unquoted service path” vulnerability in the Schneider Electric Floating License Manager, produced a patchSchneider Electric Security Notification SEVD 2014-015-01v3,...

UBUNTU-CVE-2014-8712

The buildexpertdata function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a data structure, which allows remote attackers to cause a denial of service application crash via a crafted packet...

DAMM - Differential Analysis of Malware in Memory

An open source memory analysis tool built on top of Volatility. It is meant as a proving ground for interesting new techniques to be made available to the community. These techniques are an attempt to speed up the investigation process through data reduction and codifying some expert knowledge...

Schneider Electric ClearSCADA Uncontrolled Resource Consumption Vulnerability

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an uncontrolled resource consumption vulnerability in the Schneider Electric SCADA Expert ClearSCADA software. Schneider Electric has produced a new version that mitigates this vulnerability. Adam Crain has...

Schneider Electric SCADA Expert ClearSCADA < 2014 R1.1 and Schneider Electric ClearSCADA < 2010 R3.2 Multiple Vulnerabilities

Binary data 8391.prm...

Schneider Electric SCADA Expert ClearSCADA Authentication Bypass (CVE-2014-5412)

An information disclosure vulnerability exists in Schneider Electric SCADA Expert ClearSCADA. This vulnerability is due to insufficient restrictions of the preconfigured guest account. A remote attacker can exploit this vulnerability to disclose sensitive system information...

CVE-2014-5411

Multiple cross-site scripting XSS vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...