Mitsubishi Electric MELSEC-Q Series PLCs

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: MELSEC-Q series PLCs Vulnerability: Resource Exhaustion 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to send...

PT-2019-9479 · Comodo · Comodo Utm Firewall

Name of the Vulnerable Software and Affected Versions: Comodo UTM Firewall versions prior to 2.7.0 Description: The issue allows remote attackers to execute arbitrary code without authentication via a crafted URL. This is related to the Web Console in Comodo UTM Firewall. Recommendations: For...

OPNsense 18.7 Cross Site Scripting

Exploit Title: OPNsense 18.7 | Cross-Site Scripting Date: 28.01.2019 Exploit Author: Ozer Goker Vendor Homepage: https://opnsense.org Software Link: http://mirror.ams1.nl.leaseweb.net/opnsense/releases/mirror/OPNsense-18.7-OpenSSL-dvd-amd64.iso.bz2 Version: 18.7 Introduction OPNsense is an open...

pfSense 2.4.4-p1 Cross Site Scripting

Exploit Title: pfSense 2.4.4-p1 | Cross-Site Scripting Date: 28.01.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.pfsense.org Software Link: https://frafiles.pfsense.org/mirror/downloads/pfSense-CE-2.4.4-RELEASE-p1-amd64.iso.gz Version: 2.4.4-p1 Introduction pfSenseAr software is a...

Citrix Web Application Firewall : 400 Bad Request

Getting the error "The request failed with HTTP status 400:." when opening an application hosted using a Load balancing Virtual Server when Application Firewall Profile is bound. Sample entry seen in /var/log/ns.log : Nov 22 09:49:45 172.25.224.219 11/22/2018:09:49:45 GMT qahvpxlb09 0-PPE-1 :...

Junos OS: EX2300 and EX3400 series: Certain stateless firewall filter rules might not take effect (JSA10901)

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability in which stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. C Tenable Network Security, Inc...

China Blocks Microsoft's Bing Search Engine, Despite Offering Censored Results

Update: Microsoft's search engine Bing has been restored in China after being inaccessible in the country for almost two days. According to sources familiar with the matter, Bing was blocked due to an accidental technical error and not due to an attempt at censorship. China has blocked...

China Blocks Microsoft's Bing Search Engine, Despite Offering Censored Results

Update: Microsoft's search engine Bing has been restored in China after being inaccessible in the country for almost two days. According to sources familiar with the matter, Bing was blocked due to an accidental technical error and not due to an attempt at censorship. China has blocked...

Endian Firewall Community release 3.3.0 Cross Site Scripting

Exploit Title: Endian Firewall Community release 3.3.0 | Cross-Site Scripting Date: 24.01.2019 Exploit Author: Ozer Goker Vendor Homepage: https://www.endian.com Software Link: https://sourceforge.net/projects/efw/files/Development/EFW-3.3.0/ Version: 3.3.0 Introduction Endian Firewall Community...

Cross-Site Scripting (XSS) in PAN-OS External Dynamic Lists

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS External Dynamic Lists. Ref. PAN-106776; CVE-2019-1565 Successful exploitation of this issue may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject...

Security Bulletin: Security Vulnerability in IBM WebSphere Application Server shipped with IBM Tivoli Netcool Configuration Manager(CVE-2015-3183)

Summary There are vulnerabilities reported in IBM Websphere 7.0.0.37. IBM Tivoli Netcool Configuration Manager is affected by the following. Request smuggling vulnerability may affect the IBM HTTP Server used by IBM WebSphere Application Server Vulnerability Details CVEID: CVE-2015-3183...

Check Point ZoneAlarm 8.8.1.110 - Local Privilege Escalation Exploit

Exploit for windows platform in category local exploits Exploit Title: Check Point ZoneAlarm Local Privilege Escalation Exploit Author: Chris Anastasio Vendor Homepage: https://www.zonealarm.com/software/free-antivirus/ Software Link: Vulnerable Versions included in repo Version: ZoneAlarm Free...

Rockwell Windows Firewall Configuration Utility Detection (Windows SMB Login)

SMB login-based detection of Rockwell Windows Firewall Configuration Utility. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ABB CP400 Panel Builder TextEditor 2.0

1. EXECUTIVE SUMMARY CVSS v7.0 Vendor: ABB Equipment: CP400 Panel Builder TextEditor 2.0 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, and cause a denial-of-service condition within the...

Check Point ZoneAlarm 8.8.1.110 - Local Privilege Escalation

Check Point ZoneAlarm 8.8.1.110 - Local Privilege Escalation Exploit Title: Check Point ZoneAlarm Local Privilege Escalation Date: 1/16/19 Exploit Author: Chris Anastasio Vendor Homepage: https://www.zonealarm.com/software/free-antivirus/ Software Link: Vulnerable Versions included in repo Versio...

Check Point ZoneAlarm 8.8.1.110 - Local Privilege Escalation

Exploit Title: Check Point ZoneAlarm Local Privilege Escalation Date: 1/16/19 Exploit Author: Chris Anastasio Vendor Homepage: https://www.zonealarm.com/software/free-antivirus/ Software Link: Vulnerable Versions included in repo Version: ZoneAlarm Free Antivirus + Firewall version: 15.3.064.1772...

VOIPO Database Exposes Millions of Texts, Call Logs

UPDATE An improperly secured database owned by a California voice-over-internet provider left millions of customer call logs, SMS message logs and credentials in plain text open for months for the taking. The database belongs to VOIPO, which provides mobile services for consumers and commercial...

Fortnite Flaws Allowed Hackers to Takeover Gamers' Accounts

Check Point researchers have discovered multiple security vulnerabilities in Fortnite, a massively popular online battle game, one of which could have allowed remote attackers to completely takeover player accounts just by tricking users into clicking an unsuspectable link. The reported Fortnite...

Fortnite Flaws Allowed Hackers to Takeover Gamers' Accounts

Check Point researchers have discovered multiple security vulnerabilities in Fortnite, a massively popular online battle game, one of which could have allowed remote attackers to completely takeover player accounts just by tricking users into clicking an unsuspectable link. The reported Fortnite...

Unprotected VOIP Server Exposed Millions of SMS Messages, Call Logs

A California-based Voice-Over-IP VoIP services provider VOIPO has accidentally left tens of gigabytes of its customer data, containing millions of call logs, SMS/MMS messages, and plaintext internal system credentials, publicly accessible to anyone without authentication. VOIPo is one of a leadin...