WECON PLC Editor

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: WECON Equipment: PLC Editor Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could result in unauthorized code execution within the...

Symantec Messaging Gateway Multiple Issues

SUMMARY Symantec has released an update to address issues that were discovered in the Symantec Messaging Gateway product. AFFECTED PRODUCTS Symantec Messaging Gateway --- CVE | Affected Versions | Remediation CVE-2018-12242 CVE-2018-12243 | Prior to 10.6.6 | Upgrade to 10.6.6 ISSUES CVE-2018-1224...

jwebb.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-675739 Description| Value ---|--- Affected Website:| jwebb.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Fuji Electric V-Server

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Exploitable remotely/low skill level to exploit/public exploits are available Vendor: Fuji Electric Equipment: V-Server Vulnerabilities: Use-After Free, Untrusted Pointer Dereference, Heap-based Buffer Overflow, Out-of-Bounds Write, Integer Underflow,...

The use of Microsoft Edge vulnerability to steal local files-bug warning-the black bar safety net

In 2015, Microsoft released the Edge browser. When it was originally developed, it was named Project Spartan to. With Internet Explorer different, Edge support of the broader modern security measures, such as Content Security Policy, CSP, and modern JavaScript and CSS properties. Abandon Internet...

OilRig Sends an OopsIE to Mideast Government Targets

The OilRig group is back, using a reboot of the OopsIE trojan to pump information from its favorite resource: entities in the Middle East region. OilRig, which is also called Cobalt Gypsy, Crambus, Helix Kitten or PT34, is suspected of having ties to Iran. The group was identified in 2015 and is...

ThreatList: Security Pros Confident They Could Compromise Their Own Orgs

Cyber-threats that come from within an organization – carried out by employees, former employees, contractors or business associates – represent a very real and growing concern for organizations. Risky behavior can be intentional, a la Edward Snowden, or inadvertent, as is the case with almost al...

OpenSSL Releases Security Advisory

OVERVIEW On June 5, 2014, OpenSSL announcedOpenSSL Security Advisory 05 Jun 2014, https://www.openssl.org/news/secadv20140605.txt, web site last accessed June 05, 2014. that they were releasing new versions that mitigate several additional vulnerabilities that were discovered since the last OpenS...

Defending Elections from Foreign Adversaries: Election Buster

Election Buster is an open source tool created in 2014 to identify malicious domains masquerading as candidate webpages and voter registration systems. During 2016, fake domains were used to compromise credentials of a Democratic National Committee DNC IT services company, and foreign adversaries...

Tamper proofing review: the iZettle card payment terminal

Tamper resistance is an increasingly important factor in smart devices. Together with secure hardware design and defensive coding, it can deliver a very secure device. One of the most common areas the average consumer will encounter tamper resistant devices is in payment terminals, or Pin Entry...

Safe as houses: 5 security measures adopted by cryptocurrency exchanges

By Waqas Cryptocurrencies rely on the blockchain, a decentralized ledger that records all transactions ever made within it. The blockchain network consists of multiple nodes that maintain it. To gain control over the network and tamper with transaction data a hacker should compromise most of the...

Dixons Carphone Data Breach Affects 10 Million Customers

Dixons Carphone's 2017 data breach was worse than initially anticipated. In an announcement on Monday, Dixons Carphone, one of the largest consumer electronics and telecommunication retailers in Europe, admitted that the breach affected around 10 million customers, up from an initial estimate of...

pintastic.co XSS vulnerability

Open Bug Bounty ID: OBB-655418 Description| Value ---|--- Affected Website:| pintastic.co Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

wellsoon.in XSS vulnerability

Open Bug Bounty ID: OBB-655216 Description| Value ---|--- Affected Website:| wellsoon.in Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

A Quick-Start Introduction to Database Security: An Operational Approach

The recent SingHealth data breach incident exposed around 1.5 million patients’ records. In its aftermath, the Cyber Security Agency of Singapore published a set of security measures aimed at improving the protection of Personally Identifiable Information PII data. The recommended security measur...

CVE-2018-3062 vulnerabilities

Vulnerabilities for packages: mysql...

hausschuh.com XSS vulnerability

Open Bug Bounty ID: OBB-646153 Description| Value ---|--- Affected Website:| hausschuh.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Hacker Puts Airport's Security System Access On Dark Web Sale For Just $10

If you can't find it on Google, you will definitely find it on the Dark Web. Black markets on the Dark web are not known for just buying drugs, it is a massive hidden network where you can buy pretty much anything you can imagine—from pornography, weapon, and counterfeit currencies, to hacking...

IoT domestic abuse: What can we do to stop it?

Some 40 years ago, the sci-fi/horror film Demon Seed told the tale of a woman slowly imprisoned by a sentient AI, which invaded the smart home system her husband had designed to manage it. The AI locked doors, windows, turned off communications, and even put a synthesised version of her onscreen ...

Microsoft .NET Framework CVE-2018-8284 Remote Code Execution Vulnerability

Description Microsoft .NET Framework is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected system. Failed exploit attempts will result in denial-of-service conditions. Technologies Affected Microsoft .NET...