Security researchers will disclose vulnerabilities in Embedded, ARM, x86 & NFC

Security researchers are expected to disclose new vulnerabilities in near field communication NFC, mobile baseband firmware, HTML5 and Web application firewalls next week at the Black Hat USA 2012 security conference. The Black Hat session aim to expose sometimes shocking vulnerabilities in widel...

Siemens COMOS Database Privilege Escalation Vulnerability

Overview Siemens has reported a privilege escalation vulnerability in the Siemens COMOS database application. Siemens has produced an update that fixes this vulnerability. This vulnerability could be exploited remotely. Affected Products Siemens reports that the vulnerability affects the followin...

Siemens SIMATIC S7-400 PN CPU DoS

Overview Siemens has reported to ICS-CERT that denial-of-service DoS vulnerabilities exist in the SIMATIC S7-400 V6 and SIMATIC S7-400 V5 PN CPU products. Siemens has produced a firmware update that mitigates the vulnerability affecting the S7-400 V6. Siemens will not fix the vulnerability that...

ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet - Directory Traversal

ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet - Directory Traversal ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet Unauthenticated Remote Directory Traversal Database Backup / auth-conf.xml Disclosure Exploit product homepage:...

ManageEngine Device Expert 5.6 Directory Traversal

ManageEngine DeviceExpert 5.6 Java Server ScheduleResultViewer servlet Unauthenticated Remote Directory Traversal Database Backup / auth-conf.xml Disclosure Exploit product homepage: http://www.manageengine.com/products/device-expert/ file tested: ManageEngineDeviceExpert.exe tested against:...

Measuresoft ScadaPro DLL Hijack

Overview Independent researcher Carlos Mario Penagos Hollmann identified a remotely exploitable, uncontrolled search path element vulnerability, commonly referred to as a DLL hijack, in Measuresoft’s ScadaPro application. Measuresoft has produced an upgrade to address this vulnerability. Mr...

63 Vulnerabilities on United Nation Website Exposed Online !

63 Vulnerabilities on United Nation Website Exposed Online ! Latest Notification in The Hacker News Vault by a Hacker named "Xenu Casi" from r00tw0rm Team that There are 63 Blind SQL injection Vulnerabilities exist on United Nation's Website www.un.org. Blind SQL injection is identical to normal...

Lax Security to Blame for NASDAQ Hack

The cyber attack on the NASDAQ OMX Group late last year was the result of shoddy security, according to a new report via Reuters. Computers running NASDAQ’s Director’s Desk, the software that was breached, had faulty firewalls, missing security patches and were running outdated software, like...

IT-Grundschutz M5.091: Einsatz von Personal Firewalls für Internet-PCs

IT-Grundschutz M5.091: Einsatz von Personal Firewalls für Internet-PCs. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.95070 Diese Prüfung bezieht sich auf die 12...

IT-Grundschutz M5.091: Einsatz von Personal Firewalls für Internet-PCs

IT-Grundschutz M5.091: Einsatz von Personal Firewalls für Internet-PCs. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.95070 Diese Prüfung bezieht sich auf die 12...

Nmap-scanner

This module requires argument like: "Target Host" or IP address to work. A port Scanner uses raw IP packets in novel ways to determine what hosts are available on the network It was designed to rapidly scan large networks, but works fine against single hosts Nmap "Network Mapper" is an open sourc...

Safenet Sentinel and 7-T Input Sanitization Vulnerability

Overview ICS-CERT originally released advisory ICSA-11-314-01P on the US-CERT secure portal on November 14, 2011. This web page release was delayed to allow users time to download and install the update. Security researcher Carlos Mario Penagos Hollman of Synapse-labs has identified an input...

7T Interactive Graphical SCADA System dc.exe Directory Traversal

Added: 06/03/2011 CVE: CVE-2011-1566 BID: 46936 OSVDB: 72349 Background 7-Technologies Interactive Graphical SCADA System IGSS is a Supervisory Control and Data Acquisition SCADA solution used mainly in Denmark and the US. Problem An input validation error in the Data Collector service dc.exe whe...

7T Interactive Graphical SCADA System dc.exe Directory Traversal

Added: 06/03/2011 CVE: CVE-2011-1566 BID: 46936 OSVDB: 72349 Background 7-Technologies Interactive Graphical SCADA System IGSS is a Supervisory Control and Data Acquisition SCADA solution used mainly in Denmark and the US. Problem An input validation error in the Data Collector service dc.exe whe...

Microsoft confirms Windows BROWSER protocol zero-day !

A security researcher has released proof-of-concept code for an unpatched security vulnerability affecting all versions of Windows, prompting a warning from Microsoft that remote code execution attacks are theoretically possible. Details on the vulnerability were released on the Full Disclosure...

The Shellcoder's Handbook : 1st & 2nd Edition Download

Shellcoder's Programming Uncovered Kris Kaspersky ISBN-10: 193176946X Product Description How hackers, viruses, and worms attack computers from the Internet and exploit security holes in software is explained in this outline of antivirus software, patches, and firewalls that try in vain to...

ESA-2010-015: EMC Celerra NFS authentication bypass vulnerability using IP spoofing.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2010-015: EMC Celerra NFS authentication bypass vulnerability using IP spoofing. EMC Identifier: ESA-2010-015 CVE Identifier: CVE-2010-2860 Severity Rating: CVSS v2 Base Score: 8.3 AV:A/AC:L/Au:N/C:C/I:C/A:C Affected products: EMC SW: NAS Code...

Advantech Studio Test Web Server Buffer Overflow

Overview The ICS-CERT has received a report from independent security researcher Jeremy Brown that reveals a stack-based buffer overflow vulnerability in the test web server bundled with Advantech Studio Version 6.1. This web server is intended to be used for testing purposes and should not be us...

SQL Injection Attacks Aimed at Stealing Gaming Credentials, Experts Say

The mass SQL injection attack that has been ongoing for a week or so now is designed mainly to steal credentials for online games and is quite well planned and organized, experts say. The attack, which has been using two specific domains as part of a widespread SQL injection campaign, is targetin...

Black Hat Researchers to Demo Product Hacks

A trio of researchers who discovered vulnerabilities in Cisco firewalls and in Cisco and McAfee security management software will demonstrate proof-of-concept attacks against these products at the upcoming Black Hat USA conference. Read the full article. Dark Reading...