456 matches found
Housemates. The new Red Team?
You have the VPN set up, you have 2FA, you have a good enforced password policy, firewalls are in place, you even managed to squeeze in some remote training to make employees more aware of potential phishing. You stop, breathe a sigh of relief, and then think… I've no idea who my employees live...
An update is available that contains improvements to XPS in Windows 7 or in Windows Server 2008 R2
An update is available that contains improvements to XPS in Windows 7 or in Windows Server 2008 R2 Symptoms This article introduces an update that contains improvements to XML Paper Specification XPS on a computer that is running Windows 7 or Windows Server 2008 R2. This update contains...
After the Iowa Caucus Meltdown, New Hampshire Says It’s Ready
The nation’s first primary is proudly low-tech, but it'll take more than paper ballots to defuse the disinformation threat...
The Iowa Caucus Tech Meltdown Is a Warning
The Iowa results will come in eventually, thanks to a paper trail. But it underscores just how much can go wrong when you lean on unnecessary, untested tech...
Smartphone Election in Washington State
This year: King County voters will be able to use their name and birthdate to log in to a Web portal through the Internet browser on their phones, says Bryan Finney, the CEO of Democracy Live, the Seattle-based voting company providing the technology. Once voters have completed their ballots, the...
Election Machine Insecurity Story
Interesting story of a flawed computer voting machine and a paper ballot available for recount. All ended well, but only because of that paper backup. Vote totals in a Northampton County judge's race showed one candidate, Abe Kassis, a Democrat, had just 164 votes out of 55,000 ballots across mor...
Lenovo Paper Elevation of Privilege Vulnerability
Lenovo Paper is a Chinese Lenovo Lenovo company's set of paper display mode support software. An elevation of privilege vulnerability exists in Lenovo Paper, which can be exploited by an attacker to elevate privileges...
CVE-2019-6191
A potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow local privilege escalation...
Computrols CBAS-Web 19.0.0 Username Enumeration
Computrols CBAS-Web Username Enumeration Affected versions: 19.0.0 and below CVE: CVE-2019-10848 Advisory: https://applied-risk.com/resources/ar-2019-009 Paper: https://applied-risk.com/resources/i-own-your-building-management-system Discovered by Gjoko 'LiquidWorm' Krstic Testing for non-valid...
Optergy 2.3.0a - Remote Code Execution (Backdoor)
Optergy 2.3.0a - Remote Code Execution Backdoor Title: Optergy 2.3.0a - Remote Code Execution Author: LiquidWorm Date: 2019-11-05 Vendor: https://optergy.com/ Product web page: https://optergy.com/products/ Affected version: \n' sys.exit while True: challengeurl =...
Computrols CBAS-Web 19.0.0 Information Disclosure
Computrols CBAS-Web Information Disclosure Affected versions: 19.0.0 and below CVE: CVE-2019-10849 Advisory: https://applied-risk.com/resources/ar-2019-009 Paper: https://applied-risk.com/resources/i-own-your-building-management-system by Gjoko 'LiquidWorm' Krstic $ curl -s...
Nortek Linear eMerge E3 Access Controller 1.00-06 SSH/FTP Remote Root
!/usr/bin/env python Nortek Linear eMerge E3 Access Controller SSH/FTP Remote Root Affected version: \n' sys.exit ip = sys.argv1 rshell = ssh'root', ip, password='davestyle', port=22 rshell.interactive...
Prima Access Control 2.3.35 Script Upload Remote Code Execution
Prima Access Control 2.3.35 Authenticated Python Script Upload Root RCE CVE: CVE-2019-9189 Advisory: https://applied-risk.com/resources/ar-2019-007 Paper: https://applied-risk.com/resources/i-own-your-building-management-system Discovered by Gjoko 'LiquidWorm' Krstic --- POST /bin/sysfcgi.fx...
FlexAir Access Control 2.3.35 - Authentication Bypass
Exploit Title: FlexAir Access Control 2.3.35 - Authentication Bypass Google Dork: NA Date: 2019-11-11 Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/ Version: 2.3.35 Tested on: NA...
FlexAir Access Control 2.3.35 - Authentication Bypass Exploit
Exploit for hardware platform in category web applications Exploit Title: FlexAir Access Control 2.3.35 - Authentication Bypass Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/...
eMerge E3 1.00-06 - Privilege Escalation Vulnerability
Exploit for hardware platform in category web applications Exploit Title: eMerge E3 1.00-06 - Privilege Escalation Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link: http://linear-solutions.com/nscfamily/e3-series/ Version: 1.00-06 Tested o...
eMerge E3 1.00-06 - Arbitrary File Upload
eMerge E3 1.00-06 - Arbitrary File Upload Exploit Title: eMerge E3 1.00-06 - Arbitrary File Upload Google Dork: NA Date: 2018-11-11 Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link: http://linear-solutions.com/nscfamily/e3-series/ Version:...
New News About the HITRUST Scoring Rubric and PRISMA Model
This is a high-level overview of the most significant changes about the updated HITRUST scoring rubric and PRISMA model that will affect all organizations using the HITRUST framework. It contains tips and guidance for how to prepare for upcoming HITRUST assessments. If you need a deeper dive into...
MS-ISAC Releases Security Event Primer on Malware
The Multi-State Information Sharing & Analysis Center MS-ISAC has released a Security Event Primer on Malware. The white paper outlines general malware operations and includes common malware event types and best practice recommendations. An attacker can use malware to gain access to a network,...