Majority of Sites Fail Mozilla's Comprehensive Security Review

A majority of the top 1 million websites earn an “F” letter grade when it comes to adopting defensive security technology that protect visitors from XSS vulnerabilities, man-in-the-middle attacks, and cookie hijacking. The failing grades come from a comprehensive analysis published this week by t...

In Fear of IoT Security

I wish I had a dime for every time I have heard someone say "With so many vulnerabilities being reported in the Internet of Things, I just dont trust that technology, so I avoid using any of it." I am left scratching my head because these same people seem to have no issues running a Windows...

InvoicePlane 1.4.10 File Upload / Cross Site Scripting Vulnerabilities

InvoicePlane version 1.4.10 suffers from cross site scripting and remote file upload vulnerabilities. title: Arbitrary File Upload & Stored XSS product: InvoicePlane vulnerable version: 1.4.10 fixed version: 1.5.2 CVE number: - impact: High homepage: https://invoiceplane.com/ found: 2017-04-10 by...

EnCase Forensic Imager 7.10 Buffer Overflow Vulnerability

Guidance Software EnCase Forensic Imager versions 7.10 and below suffer from a stack-based buffer overflow vulnerability. title: Stack based buffer overflow product: Guidance Software EnCase Forensic Imager vulnerable version: EnCase Forensic Imager = 7.10 fixed version: - CVE number: - impact:...

I_ Librarian 4.6/4.7 - Command Injection / Server Side Request Forgery / Directory Enumeration / Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: I, Librarian PDF manager vulnerable version: =4.6 & 4.7 fixed version: 4.8 CVE number: - impact: Critical homepage:...

MyBB 1.8.10 Server-Side Request Forgery

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Server Side Request Forgery SSRF Vulnerability product: MyBB vulnerable version: 1.8.10 fixed version: 1.8.11 CVE number: CVE-2017-7566 impact: Medium homepage:...

Solare Datensysteme Solar-Log Devices 2.8.4-563.5.2-85 - Multiple Vulnerabilities

Solare Datensysteme Solar-Log Devices 2.8.4-563.5.2-85 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Solare Datensysteme GmbH Solar-Log...

Solare Datensysteme Solar-Log Devices 2.8.4-56 / 3.5.2-85 - Multiple Vulnerabilities

Solare Datensysteme GmbH Solar-Log versions 250, 300, 500, 800e, 1000, 1000 PM+, 1200, and 2000 suffer from cross site request forgery, cross site scripting, file upload, information disclosure, and denial of service vulnerabilities title: Multiple vulnerabilities product: Solare Datensysteme Gmb...

Western Digital My Cloud Command Injection / File Upload Vulnerabilities

Exploit for hardware platform in category web applications title: Unauthenticated OS command injection & arbitrary file upload product: Western Digital My Cloud vulnerable version: at least: 2.21.126 My Cloud, 2.11.157My Cloud EX2, 2.21.126 My Cloud EX2 Ultra, 2.11.157 My Cloud EX4, 2.21.126 My...

Credential disclosure in LXCA log files - us

Lenovo Security Advisory: LEN-11635 Potential Impact: Disclosure of credentials to a non-privileged user Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2016-8233 Summary Description: During an internal security review, log files generated by Lenovo XClarity Administrator LXCA...

TYPO3 CMS 2.0.3 Cross Site Scripting Vulnerability

TYPO3 CMS versions 2.0.3 and below suffer from a cross site scripting vulnerability. title: Cross Site Scripting XSS product: Recommend Page extension for TYPO3 CMS pbrecommendpage vulnerable version: =2.0.3 fixed version: - CVE number: - impact: Medium homepage: https://typo3.org/ found:...

Sony IPELA ENGINE IP Cameras Backdoor Accounts Vulnerability

Sony IPELA ENGINE IP Cameras contain multiple backdoors that, among other functionality, allow an attacker to enable the Telnet/SSH service for remote administration over the network. Other available functionality may have undesired effects to the camera image quality or other camera functionalit...

I-Panda SolarEagle Authentication Issues / Denial Of Service

SolarEagle version 2.00 suffers from an administrative login bypass vulnerability. MPPT Solar Controller SMART2 suffers from missing server-side authentication, unencrypted communication, and denial of service issues. title: Multiple vulnerabilities product: I-Panda SolarEagle - Solar Controller...

RSA Enterprise Compromise Assessment Tool 4.1.0.1 - XML External Entity Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XML External Entity Injection XXE product: RSA Enterprise Compromise Assessment Tool ECAT vulnerable version: 4.1.0.1 fixed version: 4.1.2.0 CVE Number: - impact: Medium...

Kerio Control Unified Threat Management Code Execution / XSS / Memory Corruption

SEC Consult has also released a blog post describing the attack scenarios of the vulnerabilities within this advisory in detail and a video which shows the remote attack. Exploit code has been developed as well but will not be released for now. Blog:...

Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities

SEC Consult has also released a blog post describing the attack scenarios of the vulnerabilities within this advisory in detail and a video which shows the remote attack. Exploit code has been developed as well but will not be released for now. Blog:...

al-Alam Mobile - External URLs, KeyStore usage, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application al-Alam Mobile published at the 'play' market has multiple vulnerabilities...

Yeager CMS 1.2.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications title: Multiple Vulnerabilities product: Yeager CMS vulnerable version: 1.2.1 fixed version: 1.3 CVE number: CVE-2015-7567, CVE-2015-7568, CVE-2015-7569, CVE-2015-7570 , CVE-2015-7571, CVE-2015-7572 impact: Critical homepage:...

Fortinet(FortiGate)suspected the presence of the SSH Backdoor influence 4. 0 to 5.0.7 version-bug warning-the black bar safety net

Overview 1 On 1 2 May, twitter user@esizkur published information that the Fortigate exist ssh back door, the impact of the version from 4. 0 to 5. 0. 7, and in the link given in the attached full attack using the code. According to the disclosure of information display, the attacker can use this...

SAP Afaria - Authorization bypass, Insecure signature

Application: SAP Afaria 7.0.6001.5 Vendor URL: http://www.sap.com Bugs: Authorization bypass Reported: 12.03.2015 Vendor response: 13.03.2015 Date of Public Advisory: 12.05.2015 Reference: SAP Security Note 2134905 Authors: Dmitry Chastukhin ERPScan Description An anonymous attacker can spoof a...