Payroll Provider Gives Extortionists a Payday

Payroll software provider Apex Human Capital Management suffered a ransomware attack this week that severed payroll management services for hundreds of the company's customers for nearly three days. Faced with the threat of an extended outage, Apex chose to pay the ransom demand and begin the...

ZOHO ManageEngine Netflow Analyzer Cross-Site Scripting Vulnerability (CNVD-2019-32076)

ZOHO ManageEngine Netflow Analyzer is a set of Web-based bandwidth monitoring tools from ZOHO. The product is mainly used for bandwidth monitoring and traffic analysis. A cross-site scripting vulnerability exists in the /netflow/jspui/popup1.jsp file in ZOHO ManageEngine Netflow Analyzer...

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting

Exploit for jsp platform in category web applications !-- Exploit Title: Cross Site Scripting in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 Administration zone Date: 31-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://www.manageengine.com/products/netflow/?doc...

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 Traversal / XSS

!-- Exploit Title: Cross Site Scripting in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 Administration zone Date: 31-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://www.manageengine.com/products/netflow/?doc Softwa...

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 XSS

!-- Exploit Title: Cross Site Scripting in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 Administration zone Date: 31-01-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://www.manageengine.com/products/netflow/?doc Software Link:...

Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerabilities (CVE-2018-11784, CVE-2018-8034)

Summary IBM WebSphere Cast Iron Solution has addressed the following vulnerabilities reported in Apache Tomcat v7. Vulnerability Details CVEID: CVE-2018-11784 DESCRIPTION: Apache Tomcat could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the...

ASPRunner Professional 6.0.766 Denial Of Service

Exploit Title: ASPRunner Professional v6.0.766 - Denial of Service PoC Discovery by: Rafael Pedrero Discovery Date: 2019-01-30 Vendor Homepage: http://www.xlinesoft.com/asprunnerpro Software Link : http://www.xlinesoft.com/asprunnerpro Tested Version: v6.0.766 Tested on: Windows XP SP3...

ASPRunner Professional 6.0.766 - Denial of Service (PoC)

ASPRunner Professional 6.0.766 - Denial of Service PoC Exploit Title: ASPRunner Professional v6.0.766 - Denial of Service PoC Discovery by: Rafael Pedrero Discovery Date: 2019-01-30 Vendor Homepage: http://www.xlinesoft.com/asprunnerpro Software Link : http://www.xlinesoft.com/asprunnerpro Tested...

ASPRunner Professional 6.0.766 - Denial of Service (PoC)

Exploit Title: ASPRunner Professional v6.0.766 - Denial of Service PoC Discovery by: Rafael Pedrero Discovery Date: 2019-01-30 Vendor Homepage: http://www.xlinesoft.com/asprunnerpro Software Link : http://www.xlinesoft.com/asprunnerpro Tested Version: v6.0.766 Tested on: Windows XP SP3...

ASPRunner Professional 6.0.766 - Denial of Service Exploit

Exploit Title: ASPRunner Professional v6.0.766 - Denial of Service PoC Discovery by: Rafael Pedrero Vendor Homepage: http://www.xlinesoft.com/asprunnerpro Software Link : http://www.xlinesoft.com/asprunnerpro Tested Version: v6.0.766 Tested on: Windows XP SP3 Vulnerability Type: Denial of Service...

CB Customer Spotlight: Q&A with Ritter Insurance Marketing’s Dan McLellan

Dan McLellan is a Network Support Specialist at Ritter Insurance Marketing, and uses the Carbon Black community to increase his security knowledge and share information with his colleagues. Having access to insights from other security professionals has not only shortened the time he spends tryin...

windata professional Detection (Windows SMB Login)

SMB login-based detection of windata professional. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Managing Burnout

This is not strictly an information security post, but the topic likely affects a decent proportion of my readership. Within the last few years I experienced a profound professional "burnout." I've privately mentioned this to colleagues in the industry, and heard similar stories or requests for...

Exel Password Recovery 8.2.0.0 - Local Buffer Overflow Denial of Service

Exel Password Recovery 8.2.0.0 - Local Buffer Overflow Denial of Service Exploit Title: Excel Password Recovery Professional Date: 15-12-2018 Vendor Homepage:https://www.recoverlostpassword.com/ Software Link :https://www.recoverlostpassword.com/downloads/excelpasswordrecoveryprotrial.exe Exploit...

Excel Password Recovery 8.2.0.0 - Local Buffer Overflow Denial of Service Exploit

Exploit Title: Excel Password Recovery Professional Vendor Homepage:https://www.recoverlostpassword.com/ Software Link :https://www.recoverlostpassword.com/downloads/excelpasswordrecoveryprotrial.exe Exploit Author: Achilles Tested Version: 8.2.0.0 Tested on: Windows 7 64 Vulnerability Type: Deni...

Exel Password Recovery 8.2.0.0 Buffer Overflow / Denial Of Service

Exploit Title: Excel Password Recovery Professional Date: 15-12-2018 Vendor Homepage:https://www.recoverlostpassword.com/ Software Link :https://www.recoverlostpassword.com/downloads/excelpasswordrecoveryprotrial.exe Exploit Author: Achilles Tested Version: 8.2.0.0 Tested on: Windows 7 64...

CVE-2018-13813

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...

Jetpack <= 6.4.2 - Authenticated Stored Cross-Site Scripting (XSS)

According to RIPS Technologies: "RIPS detected a Stored XSS vulnerability that affects a module available to premium and professional users of Jetpack. Attackers who gained control over an account on the target site with at least Contributor privileges were able to inject arbitrary JavaScript cod...

Become a Certified Hacker With This Hands-On Training Course

It seems as though not a day goes by without news spreading over another major cyber attack. Hackers are becoming increasingly efficient at targeting everything from small startups to Fortune 500 companies and even entire government agencies, and as the world moves further away from traditional...

Microsoft Project 2013 Remote Code Execution Vulnerability (KB4461489)

This host is missing a critical security update according to Microsoft KB4461489 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...