Fedora pure-ftpd misconfiguration vulnerability

Fedora is a Linux-based operating system developed by the Fedora Project community and sponsored by Red Hat. pure-ftpd is one of the FTP service programs. A misconfiguration vulnerability exists in Downstream version 1.0.46-1 of pure-ftpd in Fedora. A remote attacker could exploit this...

[slackware-security] ruby

New ruby packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/ruby-2.2.8-i586-1slack14.2.txz: Upgraded. This release includes several security fixes. For more information, see:...

Google Chrome Will Mark FTP Resources As “Not Secure”

By Uzair Amir It seems like Google is making some serious changes in This is a post from HackRead.com Read the original post: Google Chrome Will Mark FTP Resources As Not Secure...

Foscam C1 Webcam FTP Hard Coded Password Vulnerability(CVE-2016-8731)

Summary Hard-coded FTP credentials r:r are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device. Tested Versions Foscam C1 Firmware Version...

WordPress Media from FTP Plugin <= 9.79 - Authenticated PHP Object Injection Vulnerability

WordPress Media from FTP Plugin Authenticated PHP Object Injection Vulnerability was found in 9.79 version. WordPress Media from FTP Plugin makes the function mediafromftpmedialibraryimportupdatecallback accessible through WordPress’ AJAX functionality to those logged in to WordPress in the file...

[slackware-security] libzip

New libzip packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libzip-1.0.1-i586-3slack14.2.txz: Rebuilt. Fix a denial of service security issue. For more information, see:...

[slackware-security] emacs

New emacs packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/emacs-25.3-i586-1slack14.2.txz: Upgraded. This update fixes a security vulnerability in Emacs. Gnus no...

UPDATE: Gloom-Framework v1.7.5

PenTestIT RSS Feed Update time guys! Please refer my initial blog post about this open source penetration testing framework for Kali Linux. I just saw that it has been updated and we now have Gloom-Framework v1.7.5 with new features and a lot of bug fixes. Actually, it was updated quiet a number ...

cFire: IP Discovery for Domains behind Cloudflare

PenTestIT RSS Feed If you remember, I blogged about a CloudFail and HatCloud earlier. Those tools help you find the IP addresses of systems that are protected/behind Cloudflare. This post is about a new tool on the block - cFire, which just does not stop at detecting the systems restricted using...

[slackware-security] bash

New bash packages are available for Slackware 13.1, 13.37, 14.0, 14.1, and 14.2 to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/bash-4.3.048-i586-1slack14.2.txz: Upgraded. This update fixes two security issues found in bash before 4.4: The expansio...

Oracle Java JDK/JRE < 1.8.0.131 / Apache Xerces 2.11.0 - 'PDF/Docx' Server Side Denial of Service

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in Oracle Java JDK/JRE 1.8.0.131 and previous versions packages and Apache Xerces 2.11.0 The vulnerabilities are: Oracle JDK/JRE Concurrency-Related Denial of Service java.net.URLConnection with no...

Brickcom IP Camera - Credentials Disclosure

Advisory Information ======================================== Title: Brickcom IP-Camera Remote Credentials and Settings Disclosure Vendor Homepage: http://www.brickcom.com Tested on Camera types: WCB-040Af, WCB-100A, WCB-100Ae, OB-302Np, OB-300Af, OB-500Af Remotely Exploitable: Yes...

FTP Made Easy PRO 1.2 - SQL Injection

FTP Made Easy PRO 1.2 - SQL Injection Exploit Title: FTP Made Easy PRO 1.2 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://nelliwinne.net/ Software Link: https://codecanyon.net/item/ftp-made-easy-pro-php-multiple-ftp-manager-client-with-code-editor/17460747 Demo:...

FTP Made Easy PRO 1.2 - SQL Injection

Exploit Title: FTP Made Easy PRO 1.2 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://nelliwinne.net/ Software Link: https://codecanyon.net/item/ftp-made-easy-pro-php-multiple-ftp-manager-client-with-code-editor/17460747 Demo: http://codecanyon.nelliwinne.net/FTPMadeEasyPRO/...

FTP Made Easy PRO 1.2 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FTP Made Easy PRO 1.2 - SQL Injection Dork: N/A Date: 28.08.2017 Vendor Homepage: http://nelliwinne.net/ Software Link: https://codecanyon.net/item/ftp-made-easy-pro-php-multiple-ftp-manager-client-with-code-editor/17460747 Demo...

CentOS 7 : curl (CESA-2017:2016)

An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Updated xmlsec1 packages fix security vulnerability

It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion XXE along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service CVE-2017-1000061...

NetSarang Xftp 5 Backdoor Trojan (ShadowPad)

The Xftp 5, an FTP client for Windows, installed on the remote host has a nssock2.dll file identified by its MD5 hash that is infected with a trojan backdoor. The affected file includes an encrypted payload that could be remotely activated by a knowledgeable attacker. C Tenable Network Security,...

CVE-2017-6774

A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify sensitive system files. The vulnerability is due to the inclusion of sensitive system files within specific FTP...

Code injection

A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify sensitive system files. The vulnerability is due to the inclusion of sensitive system files within specific FTP...