IBM Tivoli Endpoint Manager 'ScheduleParam' Cross Site Scripting Vulnerability

IBM Tivoli Endpoint Manager is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cold Disk Quick Response: CDQR

Cold Disk Quick Response tool The CDQR tool uses Plaso to parse disk images with specific parsers and create easy to analyze custom reports. The parsers were chosen based on my experience and triaging best practices and the custom reports group like items together to make analysis easier. The...

Local File Inclusion Vulnerability

More info at https://hackerone.com/reports/179034...

Chinese Manufacturer Recalls IOT Gear Following Dyn DDoS

Hangzhou Xiongmai said that it will recall millions of cameras sold in the U.S. in response to Friday’s DDoS attack against DNS provider Dyn that kept a number of web-based services such as Twitter, Github and others offline for much of the day. The Chinese manufacturer sells OEM white-label...

Unspecified Vulnerability in Oracle Fusion Middleware Oracle Platform Security for Java Component

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's business innovation platform for enterprise and cloud environments that provides middleware, software collections, and other capabilities.Oracle Platform Security for Java is one of the Java Platform Security for Java is one o...

SWIFT Confirms Banks Still Being Targeted, Announces Mitigation Tool

SWIFT’s chief information security officer said Wednesday that the cooperative is still seeing cases where its customers’ environments have been compromised. “The threat is persistent, adaptive and sophisticated – and it is here to stay,” Alain Desausoi, the cooperative’s CISO said, adding...

The vulnerability of Google Chrome’s browser allows a hacker to determine which website was visited using an HSTS connection.

The vulnerability of the CSPSource::schemeMatches function WebKit/Source/core/frame/csp/CSPSource.cpp in the CSP component of the Blink browser Google Chrome is related to errors in applying security policies designed for http and ws protocols to secure https and wss protocols. Exploiting this...

InMobi Reports - Dynamic Code Loading, External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application InMobi Reports published at the 'play' market has multiple vulnerabilities...

CVE-2016-0292

WebReports in IBM BigFix Platform formerly Tivoli Endpoint Manager 9.x before 9.5.2 allows local users to discover the cleartext system password by reading a report...

IBM BigFix WebReports Password Disclosure Vulnerability

IBM BigFix formerly known as IBM Endpoint Manager, Tivoli Endpoint Manager is a suite of system management software from IBM in the United States. The software provides remote control, patch management, software distribution, operating system deployment, network access protection, etc. BigFix...

HackerOne: Requesting Mediation possible on reports that are too old for mediation

Hi Hackerone Team, it is possible to request mediation for reports, that have the closedTooLongToMediate-parameter set to true, by requesting a mediation for a new report and changing the report id to the old report. PoC report: https://hackerone.com/reports/77834 My Request looks like: POST...

Nagios(2.2.1) network monitoring multiple CSRF

No description provided by source. document.forms0.submit input type="radio" name="group" value="1" checked="t...

Fortinet FortiAnalyzer Cross-Site Scripting Vulnerability

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The solution is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

Open Source Pentesting Management And Automation Platform: Vulnreport

Open Source Pentesting Management And Automation Platform Vulnreport is a platform for managing penetration tests and generating well-formatted, actionable findings reports without the normal overhead that takes up security engineer’s time. It is designed to accelerate management of penetration...

Navis WebAccess - SQL injection vulnerability

No description provided by source. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Product - Navis WebAccess - SQL Injection Date - 8/8/2016 Author - bRpsd Skype: vegnox Vendor HomePage - http://www.navis.com/ Product Download - http://navis.com/prwebaccess.jsp currently under...

Veris: Internal server error 500 at log.veris.in

INTRO: i have discovered an internal server error 500 at log.veris.in in sentry app & possible DoS injection with data garbage EXPLOITABILITY: Steps: 1After Sending this request Sentry is crash with an internal server error showing version of sentry and the capability of sending the issue with a...

FortiCloud - Reports Summary Persistent Vulnerabilities

Document Title: =============== FortiCloud - Reports Summary Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1735 Vulnerability Magazine:...

FortiCloud Cross Site Scripting

Document Title: =============== FortiCloud - Reports Summary Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1735 Release Date: ============= 2016-08-05 Vulnerability Laboratory ID VL-ID:...

FortiCloud - Reports Summary Persistent Vulnerabilities

Document Title: =============== FortiCloud - Reports Summary Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1735 Vulnerability Magazine:...

Zoll ePCR 2.6.4 Script Insertion

Document Title: =============== Zoll ePCR v2.6.4 iOS - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1882 Release Date: ============= 2016-08-01 Vulnerability Laboratory ID VL-ID: ====================================...