Many Factors Conspire in ICS/SCADA Attacks

Critical infrastructure operators can’t be blamed for a perpetual case of whiplash. They are mired between hackers targeting internet-facing and air-gapped systems with equal precision, and vendors and management unwilling to properly tackle security for fear of downtime and incompatibility. “The...

Microsoft not releasing patch for 20-year-old SMB flaw

By Uzair Amir Microsoft has decided to not urgently release a patch for This is a post from HackRead.com Read the original post: Microsoft not releasing patch for 20-year-old SMB flaw...

ALPINE-CVE-2017-9410

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-9101. Reason: This candidate is a duplicate of CVE-2015-9101. Notes: All CVE users should reference CVE-2015-9101 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

DEBIAN-CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

Authentication flaw

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CloudFail - Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

CloudFail is a tactical reconnaissance tool which aims to gather enough information about a target protected by CloudFlare in the hopes of discovering the location of the server. Using Tor to mask all requests, the tool as of right now has 3 different attack phases. 1. Misconfigured DNS scan usin...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

Girl Scouts to Offer Merit Badges in Cybersecurity

The Girl Scouts are going to be offering 18 merit badges in cybersecurity, to scouts as young as five years old...

UBUNTU-CVE-2017-7524

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC...

[SECURITY] Fedora 26 Update: libmwaw-0.3.11-3.fc26

libmwaw is a library for import of old Mac documents. It supports many kinds of text documents, spreadsheets, databases, vector and bitmap images. Supported are, for example, documents created by BeagleWorks, ClarisWorks, MacPaint, MacWrite or Microsoft Word for Mac. A full list of supported...

HPE SiteScope contains multiple vulnerabilities

Overview HPE's SiteScope is vulnerable to several cryptographic issues, insufficiently protected credentials, and missing authentication. Description HPE's SiteScope is vulnerable to several vulnerabilities. The researcher reports that version 11.31.461 is affected; other versions may also be...

Installer of Denshinouhin Check System (for Ministry of Agriculture, Forestry and Fisheries Nouson Seibi Jigyou) may insecurely load Dynamic Link Libraries

Overview Installer of Denshinouhin Check System for Ministry of Agriculture, Forestry and Fisheries Nouson Seibi Jigyou contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Eili Masami of Tachibana Lab. and BlackWingCat of Pink Flying Whale...

Libming Denial of Service Vulnerability

libming is a Flash SWF output library written in C for use in systems developed in PHP, Perl, etc. It can be used to output Flash SWF files to the system. A denial of service vulnerability exists in the 'readString' function in the files util/old/read.c and util/read.c in version 0.4.8 of libming...

newellsoldboys.com.ar XSS vulnerability

Vulnerable URL: http://www.newellsoldboys.com.ar/page/busquedas Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1026475 VIP website status:| No Check newellsoldboys.com.ar SSL...

CVE-2016-4435

An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a...

PT-2017-15193 · Codecanyon · Yop Poll

Name of the Vulnerable Software and Affected Versions: YOP Poll versions prior to 5.8.1 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations: For versions prior to 5.8.1, update to version 5.8.1 or later to resolve the issue...

Arbitrary User Password Reset Vulnerability in Kingsoft Wordsmith Android App

Kingsoft Wordsmith is a free translation and learning software from Kingsoft. Kingsoft wordmaster android app there is any user password reset vulnerability, the vulnerability arises from the change of password did not increase the verification of the old password due to the attacker can take...

CVE-2016-9462

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to...