[SECURITY] Fedora 25 Update: php-PHPMailer-5.2.24-1.fc25

Full Featured Email Transfer Class for PHP. PHPMailer features: Supports emails digitally signed with S/MIME encryption! Supports emails with multiple TOs, CCs, BCCs and REPLY-TOs Works on any platform. Supports Text & HTML emails. Embedded image support. Multipart/alternative emails for mail...

Continental AG Infineon S-Gold 2 (PMB 8876)

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: Continental AG Equipment: Infineon S-Gold 2 PMB 8876 Vulnerabilities: Stack-Based Buffer Overflow, Improper Restriction of Operations within the Bounds of a Memory Buffer AFFECTED PRODUC...

Interactive Security Reference Tool: BroSec

Interactive Security Reference Tool An interactive reference tool to help security professionals utilize useful payloads and commands Brosec is a terminal based reference utility designed to help us infosec bros and broettes with useful yet sometimes complex payloads and commands that are often...

Schneider Electric U.motion Builder runscript directory traversal vulnerability

U.motion Builder is a builder product from Schneider Electric France. A directory traversal vulnerability exists in the Schneider Electric U.motion Builder runscript. When handling the 's' parameter of a small application. An attacker could exploit the vulnerability to expose files from the syste...

S-CMS V3.0 build20170601 has an arbitrary file download vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS V3.0 build20170601 '/admin/download.asp' page has an arbitrary file download vulnerability, allowing attackers to exploit the vulnerability to download database information...

congress.gov XSS vulnerability

Vulnerable URL: https://www.congress.gov/bill/114th-congress/senate-bill/3542/cosponsors?q="search":"S.+3542"=1"/Style=position:fixed;top:0;left:0;font-size:999px;/Onmouseenter=confirmOPENBUGBOUNTY//"' /Style=position:fixed;top:0;left:0;font-size:999px; /Onmouseenter=confirmOPENBUGBOUNTY //...

Dedicated Machine Learning Behind Early Phishing Detection in Gmail

Cybercrime and state-sponsored advanced attacks continue to cling to email as a primary distribution vehicle for first-stage malware. Phishing campaigns thrive in targeted attacks, and criminals have even resuscitated old-school macro malware in attachments to gain that initial foothold on a...

s-c-r.de XSS vulnerability

Open Bug Bounty ID: OBB-241583 Description| Value ---|--- Affected Website:| s-c-r.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

s-estia.gr XSS vulnerability

Vulnerable URL: http://www.s-estia.gr/pdetails?id==Σ-=en Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4593013 VIP website status:| No Check s-estia.gr SSL connection:| Grade: F...

Microsoft OneDrive iOS App 8.13 Insecure URI Scheme Handling

A short demo video is available here: https://youtu.be/0jZdM9peVSk SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure Handling Of URI Schemes product: Microsoft OneDrive iOS App vulnerable version: 8.13 fixed...

PT-2017-3763 · Siemens · Hmi Mobile Panels +4

Name of the Vulnerable Software and Affected Versions: Siemens PROFINET DCP versions affected versions not specified SIMATIC HMI Multi Panels and HMI Mobile Panels affected versions not specified S7-300/S7-400 devices affected versions not specified Description: The issue is related to insufficie...

Mozilla Network Security Service (NSS): Multiple vulnerabilities

Background The Mozilla Network Security Service NSS is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description Multiple vulnerabilities have been discovered in NSS. Please review the CVE identifiers referenced...

perrehaber.com XSS vulnerability

Vulnerable URL: https://www.perrehaber.com/?s="/alert/OPENBUGBOUNTY/...

Brother MFC-J6520DW Password Change Authentication Bypass

ASCII hex -- md5 e.g. AuthCookie=c243a9ee18a9327bfd419f31e75e71c7 for 'test' password This information can be used to crack current password from exported cookie. Fix: Minimize network access to Brother MFC device or disable HTTPS interface. Confirmed vulnerable: MFC-J6973CDW MFC-J4420DW MFC-8710...

Design/Logic Flaw

Unquoted Windows search path vulnerability in the guest service in Unisys s-Par before 4.4.20 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe...

CVE-2017-5873

Affected product: Unisys s-Par (guest service). Vulnerability: Unquoted Windows search path in the guest service before 4.4.20 can allow local privilege escalation via a Trojan horse executable in %SYSTEMDRIVE% (e.g., program.exe). Exploitation status: not detailed in the provided documents; Open...

CVE-2017-5873

Unquoted Windows search path vulnerability in the guest service in Unisys s-Par before 4.4.20 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe...

Brother MFC-J6520DW - Authentication Bypass Password Change

Brother MFC-J6520DW - Authentication Bypass Password Change ASCII hex -- md5 e.g. AuthCookie=c243a9ee18a9327bfd419f31e75e71c7 for 'test' password This information can be used to crack current password from exported cookie. Fix: Minimize network access to Brother MFC device or disable HTTPS...

Information Disclosure Vulnerability in Multiple Huawei Switches

Huawei S9300 and others are S-series switches from Huawei, a Chinese company. An information disclosure vulnerability exists in several Huawei switches using the VRP platform. An attacker can exploit this vulnerability to disclose network device interface IP address information...

Sweepstakes Pro Software SQL Injection Vulnerability

Sweepstakes Pro Software is a suite of sweepstakes software to increase email lists, increase social networking, and drive sales by running sweepstakes software in conjunction with sweepstakes. A SQL injection vulnerability exists in the s parameter in both win.php and widgetlb.php in Sweepstakes...