Improper access control

Computing For Good's Basic Laboratory Information System also known as C4G BLIS version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may enumerate the user names and facility names in use on a particular installation...

Improper access control

Computing For Good's Basic Laboratory Information System also known as C4G BLIS version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator...

CVE-2019-5643

CVE-2019-5643 affects Computing For Good’s Basic Laboratory Information System (C4G BLIS) up to version 3.5. The issue is CWE-284 (Improper Access Control). An unauthenticated user could enumerate usernames and facility names on a targeted installation. The Connected documents confirm the vulnera...

CVE-2019-5644

CVE-2019-5644 affects Computing For Good’s Basic Laboratory Information System (C4G BLIS) b3.5 and earlier. The issue is CWE-284 Improper Access Control, leading to an unauthenticated user potentially altering user accounts, including promoting a user to administrator. The vulnerability is rooted...

CVE-2019-5617

CVE-2019-5617 affects Computing For Good’s Basic Laboratory Information System (BLIS) v3.4 and earlier. The root cause is CWE-284, Improper Access Control, allowing an unauthenticated user to change the password of any administrator‑level user via a network attack. The CVSS‑3.1 vector (AV:N/AC:L/...

UBUNTU-CVE-2019-12269

Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text...

Over Dozen Popular Email Clients Found Vulnerable to Signature Spoofing Attacks

A team of security researchers has discovered several vulnerabilities in various implementations of OpenPGP and S/MIME email signature verification that could allow attackers to spoof signatures on over a dozen of popular email clients. The affected email clients include Thunderbird, Microsoft...

4 tried-and-true prevention strategies for enterprise-level security

Why is it that dentists advise people over and over to floss, yet so few do it? It only takes a minute of your time, yet if you’re running late or feeling tired, you may be tempted to skip it. That is until you remember your upcoming teeth cleaning appointment. There is nothing like the memory of...

IP-Tools 2.5 Local Buffer Overflow

!/usr/bin/env python ------------------------------------------------------------------------------------------------------------------------------------ Exploit: IP-Tools 2.5 - Local Buffer OverflowEggHunter Date: 2019-02-06 Author: Juan Prescotto Tested Against: Win7 Pro SP1 64 bit Software...

IP-Tools 2.5 - Log to file Local Buffer Overflow (SEH) (Egghunter)

IP-Tools 2.5 - Log to file Local Buffer Overflow SEH Egghunter !/usr/bin/env python ------------------------------------------------------------------------------------------------------------------------------------ Exploit: IP-Tools 2.5 - Local Buffer OverflowEggHunter Date: 2019-02-06 Author:...

IP-Tools 2.5 - Local Buffer Overflow (SEH) (Egghunter) Exploit

Exploit for windows platform in category local exploits !/usr/bin/env python ------------------------------------------------------------------------------------------------------------------------------------ Exploit: IP-Tools 2.5 - Local Buffer OverflowEggHunter Date: 2019-02-06 Author: Juan...

Guide to Developing a National Cybersecurity Strategy—a resource for policymakers to respond to cybersecurity challenges

Nations from every corner of the world are increasingly leveraging digital transformation to grow their economies and empower businesses to improve services, including vital services provided by critical infrastructures. This adoption of new information communications technologies ICT has...

Understanding NetScaler SD-WAN Best Path Determination

The following points helps you in understanding NetScaler SD-WAN best path determination: Per-packet determination Variety of factors in determining packets assigned path Received packet from any WAN path calculates: One-way trip latency One-way loss One-way bandwidth One-way jitter Sent packet...

thunderbird: S/MIME and PGP decryption oracles can be built with HTML emails

Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird 52.9...

Integer overflow

The mintToken function of a smart contract implementation for Good Time Coin GTY, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

Good Time Coin Integer Overflow Vulnerability

Good Time Coin GTY is a tradable Ether ERC20 token. An integer overflow vulnerability exists in the mintToken function of Good Time Coin's smart contract implementation. The vulnerability can be exploited by the contract owner to set the balance of any user to any value...

CVE-2018-13084

CVE-2018-13084 concerns Good Time Coin (GTY) ERC20 token. The vulnerability resides in the mintToken function of GTY’s smart contract, where an integer overflow can enable the contract owner to set the balance of any arbitrary user to a chosen value. This description is consistent across multiple...

Critical Flaws in PGP and S/MIME Tools Can Reveal Encrypted Emails in Plaintext

Note— the technical details of the vulnerabilities introduced in this article has now been released, so you should also read our latest article to learn how the eFail attack works and what users can do to prevent themselves. An important warning for people using widely used email encryption...

good-for-wood.com XSS vulnerability

Open Bug Bounty ID: OBB-612481 Description| Value ---|--- Affected Website:| good-for-wood.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Denial of Service Vulnerability in Good Photo Image Processing Software for Processing BMP Images

Good Photo is a multi-platform professional-grade image processing software developed by Chengdu Hengtu Technology Co. A memory corruption vulnerability exists in the processing of BMP images by Good Photo image processing software. An attacker can cause the program to crash by constructing a...