How to add new XenMobile nodes in environments with Rolling Patches installed

Step by step on how to add new XenMobile nodes when the the environment already has Rolling Patches installed...

Forced Entry: A Security Test for Automatic Garage Doors

In this blog entry we revisit threats to automatic garage doors by using SDR to test two attack scenarios. We demonstrate a rolling code attack and one that involves a hidden remote feature...

Forced Entry: A Security Test for Automatic Garage Doors

In this blog entry we revisit threats to automatic garage doors by using SDR to test two attack scenarios. We demonstrate a rolling code attack and one that involves a hidden remote feature...

Design/Logic Flaw

GAEN aka Google/Apple Exposure Notifications through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location history, in-person social graph, and sometimes COVID-19 infection status, because Rolling Proximity Identifiers and MAC addresses are written to t...

Citrix Endpoint Management (aka XenMobile Server) 10.9.0 Rolling Patch 5

Package name:xms10.9.0.10507.bin For: XenMobile Server 10.9.0 Deployment type: On-premises only Replaces:xms10.9.0.10405.bin, xms10.9.0.10303.bin, xms10.9.0.10204.bin, xms10.9.0.10105.bin Date:July, 2020 Languages supported:English US Readme version:1.00 Readme Revision History Version| Date|...

Citrix Endpoint Management (CEM) Security Update

Description of Problem Multiple vulnerabilities have been discovered inCitrix Endpoint Management CEM,also referred to asXenMobile. These vulnerabilitieshavethe following identifiers: CVE-2020-8208 CVE-2020-8209 CVE-2020-8210 CVE-2020-8211 CVE-2020-8212 CVE-2020-8253 The following versions ofCitr...

Elasticsearch Field Disclosure Vulnerability

Elasticsearch is a search engine based on the Lucene library. A field disclosure vulnerability exists in Elasticsearch versions prior to 7.9.0, 6.8.12 when running a rolling search using Field Level Security. An attacker can exploit this vulnerability to gain access to fields that are supposed to...

Apple/Google Exposure Notification API Information Disclosure Vulnerability

The Apple/Google Exposure Notification API is a contact tracking survey application for pandemic diseases. An information disclosure vulnerability exists in the Apple/Google Exposure Notification API beta 2020-05-29 and earlier versions, which can be exploited by an attacker to bypass Bluetooth...

Design/Logic Flaw

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device...

CVE-2020-13702

The CVE-2020-13702 entry concerns the Rolling Proximity Identifier used by the Apple/Google Exposure Notification API (beta through 2020-05-29). A secondary temporary UID enables attackers within Beacon/IoT networks to track an individual device’s movements via Bluetooth LE discovery, compromisin...

CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin)

CandidATS 2.1.0 - Cross-Site Request Forgery Add Admin Title: CandidATS 2.1.0 - Cross-Site Request Forgery Add Admin Date: 2020-02-21 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/u/auieo/profile/ Software Link: https://sourceforge.net/projects/candidats/files/Version 2.1.0...

eLection 2.0 SQL Injection

Title: eLection 2.0 - 'id' SQL Injection Date: 2020-02-21 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/election-by-tripath/ Software Link: https://sourceforge.net/projects/election-by-tripath/files/Version 2.0 Tested on Ubuntu 19/Kali Rolling The eLection Web...

eLection 2.0 - id SQL Injection

eLection 2.0 - id SQL Injection Title: eLection 2.0 - 'id' SQL Injection Date: 2020-02-21 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/election-by-tripath/ Software Link: https://sourceforge.net/projects/election-by-tripath/files/Version 2.0 Tested on Ubuntu 19/Ka...

eLection 2.0 - (id) SQL Injection Vulnerability

Exploit for php platform in category web applications Title: eLection 2.0 - 'id' SQL Injection Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/election-by-tripath/ Software Link: https://sourceforge.net/projects/election-by-tripath/files/Version 2.0 Tested on Ubuntu...

eLection 2.0 - 'id' SQL Injection

Title: eLection 2.0 - 'id' SQL Injection Date: 2020-02-21 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/election-by-tripath/ Software Link: https://sourceforge.net/projects/election-by-tripath/files/Version 2.0 Tested on Ubuntu 19/Kali Rolling The eLection Web...

Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User) Vulnerability

Exploit for php platform in category web applications Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Exploit Author: J3rryBl4nks Vendor Homepage: https://icehrm.com/ Software Link: https://sourceforge.net/projects/icehrm/Version 26.2.0 Tested on Windows 10/Kali Rolling The Ic...

SOPlanning 1.45 - Cross-Site Request Forgery (Add User) Vulnerability

Exploit for php platform in category web applications Exploit Title: SOPlanning 1.45 - Cross-Site Request Forgery Add User Exploit Author: J3rryBl4nks Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/ Version 1.45 Tested o...

SOPlanning 1.45 SQL Injection

Exploit Title: SOPlanning 1.45 - 'users' SQL Injection Date: 2020-02-14 Exploit Author: J3rryBl4nks, Homebrewer Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/ Version 1.45 Tested on Windows 10/Kali Rolling The SOPlannin...

phpMyChat Plus 1.98 - (pmc_username) SQL Injection Vulnerability

Exploit for php platform in category web applications Title: phpMyChat Plus 1.98 - 'pmcusername' SQL Injection Exploit Author: J3rryBl4nks Vendor Homepage: http://ciprianmp.com/latest/ Software Link: https://sourceforge.net/projects/phpmychat/files/phpMyChatPlus/ Version MyChat Plus 1.98 Tested o...

phpMyChat Plus 1.98 - pmc_username SQL Injection

phpMyChat Plus 1.98 - pmcusername SQL Injection Title: phpMyChat Plus 1.98 - 'pmcusername' SQL Injection Date: 2020-02-13 Exploit Author: J3rryBl4nks Vendor Homepage: http://ciprianmp.com/latest/ Software Link: https://sourceforge.net/projects/phpmychat/files/phpMyChatPlus/ Version MyChat Plus 1....