Airplanes Can Be Hacked Through Wireless In-flight Entertainment System

Almost a year ago, at the ‘Hack In The Box’ security summit in Amsterdam, a security researcher at N.Runs and a commercial airline pilot, Hugo Teso presented a demonstration that it's possible to take control of aircraft flight systems and communications using an Android smartphone and some...

Apple Strongly Denies Claims of Installing iOS Backdoor

The allegations from a data forensic expert and security researcher that iOS contains a “backdoor” permitting third parties to potentially gain access to large amount of users' personal data instigated Apple to give a strong response. The company has completely denied to the claims published over...

Pina CMS - Multiple Vulnerabilities

No description provided by source. Title: Pina CMS SQL Injection and XSS Vulnerabilities Vendor: www.pinacms.com Vendor Notified: 15-02-2014 Vendor Replied: 16-02-2014 Release in Public: 18-02-2014 Tested on: Windows/Linux Author/Found by: Shadman Tanjim Website: www.secupent.com and...

eXPert PDF Reader 4.0 NULL Pointer Dereference and Heap Corruption

No description provided by source. !/usr/local/bin/perl eXPert PDF Reader 4.0 NULL Pointer Dereference and Heap Corruption Denial Of Service Vendor: Visagesoft Product web page: http://www.visagesoft.com Affected version: 4.0.210 Summary: eXPert PDF Reader is a free pdf viewer software that lets...

CoolPlayer+ Portable 2.19.2 - Buffer Overflow ASLR Bypass (Large Shellcode)

No description provided by source. !/usr/bin/ruby Exploit for CoolPlayer+ Portable 2.19.2 Based on exploit by Blake and Dhruval. Vulnerability found by Securityxxxpert Original: http://www.exploit-db.com/exploits/20262/ This one by Robert Larsen [email protected] Lots of room for shellcode...

AskMe Pro 2.1 (que_id) SQL Injection Vulnerability

No description provided by source. / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

CoolPlayer Portable 2.19.2 - Buffer Overflow (MSF)

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

Wireshark v1.11.3 - The world’s foremost network protocol analyzer

Wireshark is the world’s foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto and often de jure standard across many industries and educational institutions. Wireshark development thrives thanks to the...

CVE-2014-0779

The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build...

CVE-2014-0779 Schneider Electric StruxureWare SCADA Expert ClearSCADA Improper Restriction of Operations within the Bounds of a Memory Buffer

The PLC driver in ServerMain.exe in the Kepware KepServerEX 4 component in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R2 build 71.4165, 2010 R2.1 build 71.4325, 2010 R3 build 72.4560, 2010 R3.1 build 72.4644, 2013 R1 build 73.4729, 2013 R1.1 build 73.4832, 2013 R1.1a build...

CVE-2013-2824

Schneider Electric StruxureWare SCADA Expert Vijeo Citect 7.40, Vijeo Citect 7.20 through 7.30SP1, CitectSCADA 7.20 through 7.30SP1, StruxureWare PowerSCADA Expert 7.30 through 7.30SR1, and PowerLogic SCADA 7.20 through 7.20SR1 do not properly handle exceptions, which allows remote attackers to...

CVE-2013-2824

CVE-2013-2824 affects Schneider Electric StruxureWare SCADA Expert Vijeo Citect (v7.40), Vijeo Citect (v7.20–7.30SP1), CitectSCADA (v7.20–7.30SP1), StruxureWare PowerSCADA Expert (v7.30–7.30SR1), and PowerLogic SCADA (v7.20–7.20SR1). The issue is an exception-handling flaw that allows remote atta...

Pina CMS - Multiple Vulnerabilities

Pina CMS - Multiple Vulnerabilities Title: Pina CMS SQL Injection and XSS Vulnerabilities Vendor: www.pinacms.com Vendor Notified: 15-02-2014 Vendor Replied: 16-02-2014 Release in Public: 18-02-2014 Tested on: Windows/Linux Author/Found by: Shadman Tanjim Website: www.secupent.com and...

Pina CMS SQL Injection and XSS Vulnerabilities

Exploit for php platform in category web applications Title: Pina CMS SQL Injection and XSS Vulnerabilities Vendor: www.pinacms.com Vendor Notified: 15-02-2014 Vendor Replied: 16-02-2014 Release in Public: 18-02-2014 Tested on: Windows/Linux Author/Found by: Shadman Tanjim Website: www.secupent.c...

NSA allegedly hacked Belgian Cryptography Expert with spoofed LinkedIn Profile

Cryptographer Professor Jean-Jacques Quisquater has become the part of a targeted attack by the US National Security Agency NSA and its British counterpart GCHQ, first reported on Saturday morning by De Standaard. A few months back in September 2013 it was revealed that, Belgacom, the largest...

DHS Warns of Schneider Electric ClearSCADA Vulnerability

The Department of Homeland Security is warning the maintainers of industrial control systems ICS about a remotely exploitable uncontrolled resource consumption vulnerability in Schneider Electric’s ClearSCADA software. Schneider Electric says that it has developed a new version of ClearSCADA that...

CVE-2013-6142

DNP3Driver.exe in the DNP3 driver in Schneider Electric ClearSCADA 2010 R2 through 2010 R3.1 and SCADA Expert ClearSCADA 2013 R1 through 2013 R1.2 allows remote attackers to cause a denial of service resource consumption via IP packets containing errors that trigger event-journal messages...

CVE-2013-4024

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the network...

CVE-2013-4022

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x store unspecified authentication information in a cookie, which allows remote authenticated users to bypass intended access...

CVE-2013-4025

IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x do not have an off autocomplete attribute for the login-password field, which makes it easier for remote attackers to obtain...