Ricon Industrial Cellular Router S9922XL - Remote Command Execution Exploit

Exploit Title: Ricon Industrial Cellular Router S9922XL - Remote Command Execution RCE Exploit Author: LiquidWorm Vendor Homepage: https://www.riconmobile.com !/usr/bin/env python3 -- coding: utf-8 -- Ricon Industrial Cellular Router S9922XL Remote Command Execution Vendor: Ricon Mobile Inc...

Ricon Industrial Cellular Router S9922XL Remote Command Execution

!/usr/bin/env python3 -- coding: utf-8 -- Ricon Industrial Cellular Router S9922XL Remote Command Execution Vendor: Ricon Mobile Inc. Product web page: https://www.riconmobile.com Affected version: Model: S9922XL and S9922L Firmware: 16.10.3 Summary: S9922L series LTE router is designed and...

2021. The age of the super vulnerability?

I don’t know about you, but to me it seems that every week we are seeing another vulnerability that not only grants significant access to the vulnerable system but also more widely internally. This last week we have seen the latest round of Microsoft Exchange vulnerabilities. The April 2021 updat...

On Not Fixing Old Vulnerabilities

How is this even possible? …26% of companies Positive Technologies tested were vulnerable to WannaCry, which was a threat years ago, and some even vulnerable to Heartbleed. "The most frequent vulnerabilities detected during automated assessment date back to 2013-­2017, which indicates a lack of...

Western Digital My Cloud Multiple Products < 1.02.08 'Heartbleed' Vulnerability

Multiple Western Digital My Cloud products are prone to an information disclosure vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Security Bulletin: Denial of Service with WebSphere Application Server affecting Rational Application Developer (CVE-2014-0964)

Summary There is a potential denial of service with IBM WebSphere Application Server 6.0.2 and 6.1 that affects versions of WebSphere Application Server used with IBM Rational Application Developer. Vulnerability Details | Subscribe to My Notifications to be notified of important product support...

A week in security (September 9 – 15)

Last week on the Labs blog, we looked at free VPN offerings, how malware can hinder vital emergency services, and explored how the Heartbleed vulnerability is still causing problems. We also talked about a large FTC settlement involving Google, and how to keep an eye out for leaky AWS buckets...

Five years later, Heartbleed vulnerability still unpatched

The Heartbleed vulnerability was introduced into the OpenSSL crypto library in 2012. It was discovered and fixed in 2014, yet today—five years later—there are still unpatched systems. This article will provide IT teams with the necessary information to decide whether or not to apply the Heartblee...

Exploit for Out-of-bounds Read in Openssl

This repository contains a collection of exploits and tools for various vulnerabilities, including CVE-2014-0160 Heartbleed, CVE-2014-6271 Shellshock, CVE-2017-5638 Apache Struts 2, and others. The repository includes Python scripts for exploiting these vulnerabilities, as well as documentation a...

Amid Bug Bounty Hype, Sometimes Security is Left in the Dust

In January, the European Union kicked-off over a dozen new bug bounty programs targeting a bevy of popular open-source programs used by its members. The effort was supposed to be met with cheers. But instead, the launch sparked an unexpected backlash from the security community. The EU’s program...

Capital One: Heartbleed Bug

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over th...

IPv6 unmasking via UPnP

Martin Zeiser and Aleksandar Nikolich authored this post. Executive summary With tools such as ZMap and Masscan and general higher bandwidth availability, exhaustive internet-wide scans of full IPv4 address space have become the norm after it was once impractical. Projects like Shodan and Scans.i...

OSINT-SPY - Search using OSINT (Open Source Intelligence)

Performs OSINT scan on email/domain/ipaddress/organization using OSINT-SPY. It can be used by Data Miners, Infosec Researchers, Penetration Testers and cyber crime investigator in order to find deep information about their target. OSINT-SPY Documentation beta File Name : README Author : @sksecuri...

Security Bulletin: IBM Flex System Manager (FSM) and compatible IBM Systems Director agents are affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450, and CVE-2013-6449)

Summary An interface on the IBM BladeCenter Advanced Management Module AMM may expose user account names and passwords that have been configured on that AMM. Vulnerability Details Abstract The FSM and compatible agents contain a version of openssl that contained the 3 vulnerabilities listed above...

Security Bulletin: IBM Systems Director (ISD) is affected by vulnerabilities in OpenSSL (CVE-2013-4353, CVE-2013-6450, and CVE-2013-6449)

Summary : IBM Systems Director contains a version of openssl that contained the 3 vulnerabilities listed above. Vulnerability Details Abstract IBM Systems Director contains a version of openssl that contained the 3 vulnerabilities listed above. Content Vulnerability Details: CVE-ID: CVE-2013-4353...

Streamworks Job Scheduler Release 7 Authentication Weakness

Affected Products Streamworks Job Scheduler Release 7 older/newer releases have not been tested References Secuvera-SA-2016-01 https://www.secuvera.de/advisories/secuvera-SA-2016-01.txt used for updates No CVE number could be assigned vendor not listed under...

EU Offers Bug Bounties For 14 Open Source Projects

The European Commission in January is funding 14 bug bounty programs in hopes of sniffing out vulnerabilities in the free open source projects that EU institutions rely on. The bug bounty programs span 14 open source software projects and offers a total of almost $1 million for all bounties...

Which Threats had the Most Impact During the First Half of 2018?

One of the best ways for organizations to shore up their data security efforts and work toward more proactive protection is by examining trends within the threat environment. Taking a look at the strategies for attack, infiltration and infection currently being utilized by hackers can point towar...

ThreatList: Biggest Attack Targets

DO NOT SET LIVE The biggest verticals targeted by hackers in 2018, so far, are Education, Retail, Biotechnology, Construction, and Nonprofit Organizations. According to researchers at eSentire, attackers zeroed in on exploit attempts against the Education vertical, targeting consumer-grade router...

Security Bulletin: IBM Worklight is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL might allow a remote attacker to obtain sensitive information, which is caused by an error in the TLS/DTLS heartbeat functionality. An attacker might exploit this...