New Decryptor Unlocks CryptXXX v3 Files

Researchers have neutralized the threat of the latest strain of the CryptXXX v.3 ransomware, releasing a decryption tool for unlocking files, and have added it to the RannohDecryptor, a free utility hosted by Kaspersky Lab’s No Ransom Project. Previous decryption tools had been available for...

Horos 2.1.0 Web Portal Remote Information Disclosure Exploit

Summary Horos™ is an open-source, free medical image viewer. The goal of the Horos Project is to develop a fully functional, 64-bit medical image viewer for OS X. Horos is based upon OsiriX and other open source medical imaging libraries. Description Horos suffers from a file disclosure...

Orthanc DICOM Server 1.1.0 Unquoted Service Path Privilege Escalation

Summary Orthanc is a Belgian, open-source, lightweight RESTful DICOM server for healthcare and medical research with an ubiquitous web interface that enables you to upload, receive and transfer DICOM images. It comes with a REST API to automate imaging flows and an SDK to integrate with native...

OsiriX Web Portal 8.0.1 DOM Based XSS

Summary With high performance and an intuitive interactive user interface, OsiriX MD is the most widely used DICOM viewer in the world. It is the result of more than 10 years of research and development in digital imaging. It fully supports the DICOM standard for an easy integration in your...

Horos 2.1.0 DICOM Medical Image Viewer Remote Memory Overflow Vulnerability

Summary Horos™ is an open-source, free medical image viewer. The goal of the Horos Project is to develop a fully functional, 64-bit medical image viewer for OS X. Horos is based upon OsiriX and other open source medical imaging libraries. Description The vulnerability is caused due to the usage o...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-45.6.0esr-i586-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For mo...

Serva 3.0.0 HTTP Server Module Remote Denial of Service Exploit

Summary Serva is a light 3 MB, yet powerful Microsoft Windows application. It was conceived mainly as an Automated PXE Server Solution Accelerator. It bundles on a single exe all of the underlying server protocols and services required by the most complex PXE network boot/install scenarios...

Wordpress Plugin Single Personal Message 1.0.3 SQL injection vulnerability

Author:sebaoknow Chong Yu 404 security lab Date:2016-12-06 1. Vulnerability description Simple Personal Message is for WordPress website dedicated to create the privacy and security of information systems. Using Ajax operation, may be based on a group of users between the station within the...

X5 Webserver 5.0 Remote Denial Of Service Exploit

Summary X5 is the latest generation web server from iMatix Corporation. The Xitami product line stretches back to 1996. X5 is built using iMatix's current Base2 technology for multithreading applications. On multicore machines, it is much more scalable than Xitami/2. Description The vulnerability...

Peplink NGxxx/LCxxx VPN-Firewall Open Redirect Vulnerability

Summary The NG500 / 520 is a high-performance VPN server, which is suitable for small and medium enterprises to use as a VPN center. It is simple to deploy and high security. At the same time, NG500 / 520 products also integrates advanced firewall features to support access to computers by group,...

InPage Zero Day Used in Attacks Against Banks

A zero-day vulnerability in InPage publishing software used primarily in Urdu, Pashto and Arabic-speaking nations has been publicly exploited in attacks against financial institutions and government agencies in the region. While there are more than 10 million InPage users in Pakistan and India...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-45.5.0esr-i586-1slack14.2.txz: Upgraded. This release contains security fixes and improvements. For mo...

5 Major Russian Banks Hit With Powerful DDoS Attacks

Distributed Denial of Service DDoS attacks have risen enormously in past few months and, mostly, they are coming from hacked and insecure internet-connected devices, most commonly known as Internet of Things IoT. Recent DDoS attack against DNS provider Dyn that brought down a large chunk of the...

[slackware-security] mariadb

New mariadb packages are available for Slackware 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mariadb-10.0.28-i586-1slack14.2.txz: Upgraded. This update fixes several security issues. For more information, see:...

InfraPower PPS-02-S Q213V1 - Multiple Cross-Site Scripting Vulnerabilities

InfraPower PPS-02-S Q213V1 - Multiple Cross-Site Scripting Vulnerabilities InfraPower PPS-02-S Q213V1 Multiple XSS Vulnerabilities Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware:...

InfraPower PPS-02-S Q213V1 Cross-Site Request Forgery

Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...

Keen Lab Takes Down iPhone 6S, Nexus 6P, at Mobile Pwn2Own

Hackers identified a series of vulnerabilities in Android and iOS to take down a Google Nexus 6P and an Apple iPhone 6S this week at Mobile Pwn2Own. The mobile version of the popular hacking challenge, put on by Trend Micro and Tipping Point’s Zero Day Initiative, was held in tandem with the...

Chinese Hackers won $215,000 for Hacking iPhone and Google Nexus at Mobile Pwn2Own

The Tencent Keen Security Lab Team from China has won a total prize money of $215,000 in the 2016 Mobile Pwn2Own contest run by Trend Micro's Zero Day Initiative ZDI in Tokyo, Japan. Despite the implementation of high-security measures in current devices, the famous Chinese hackers crew has...

FruityArmor APT Group Used Recently Patched Windows Zero Day

One of the four zero-day vulnerabilities Microsoft patched last week was being used by an APT group called FruityArmor to carry out targeted attacks, escape browser-based sandboxes, and execute malicious code in the wild. Anton Ivanov, a researcher at Kaspersky Lab, was credited by Microsoft for...

WordPress <= 4.6.1 use the theme file to trigger stored XSS vulnerability analysis-vulnerability warning-the black bar safety net

Author: p0wd3r know Chong Yu 4 0 4 Security lab Date: 2016-10-08 0x00 vulnerability overview 1. Vulnerability description WordPress is a PHP and MySQL as a platform free and open source blogging software and content management systems, recently researchers found that in their=4.6.1 version, by...