iPass Mobile Client Service Privilege Escalation

The named pipe, \IPEFSYSPCPIPE, can be accessed by normal users to interact with the iPass service. The service provides a LaunchAppSysMode command which allows to execute arbitrary commands as SYSTEM. Module Options msf use exploit/windows/local/ipass/launchapp msf undefinedlaunchapp show action...

LiveZilla < 5.3.0.8 XSS

The version of LiveZilla hosted on the remote web server is affected by an XSS vulnerability in the Mobile Client. This flaw is caused by improper validation of user-supplied input. This vulnerability allows an attacker to execute arbitrary code in the context of the victim's browser. %NASLMINLEV...

CCTV DVR Login Scanning Utility

This module tests for standalone CCTV DVR video surveillance deployments specifically by MicroDigital, HIVISION, CTRing, and numerous other rebranded devices that are utilizing default vendor passwords. Additionally, this module has the ability to brute force user accounts. Such CCTV DVR video...

QR codes - Next way for Android Malware

Once a user scans the QR code, the code redirects them to a site that will install a Trojan on their Android smart phones. Kaspersky's SecureList blog has a report of a malicious QR code on a web site which when scanned directs the user to a URL; the linked site doesn't have a file matching the...