Code injection

SAP Netweaver 7.40 improperly logs 1 DUI and 2 DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC function callbacks by leveraging filtering of non-critical events in audit analysis reports, aka SAP Security Note 225231...

CVE-2016-7437

SAP Netweaver 7.40 improperly logs 1 DUI and 2 DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC function callbacks by leveraging filtering of non-critical events in audit analysis reports, aka SAP Security Note 225231...

CVE-2016-4551

The 1 SAPBASIS and 2 SAPABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape, aka SAP Security Note 2190621...

CVE-2016-4551

The 1 SAPBASIS and 2 SAPABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape, aka SAP Security Note 2190621...

Code injection

The 1 SAPBASIS and 2 SAPABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape, aka SAP Security Note 2190621...

CVE-2016-4551

The CVE-2016-4551 issue affects SAP NetWeaver 2004s, specifically the SAP_BASIS and SAP_ABA components (version 7.00 SP Level 0031). The root cause is a vulnerability that could allow remote attackers to spoof IP addresses written to the Security Audit Log, leveraging network landscape-related ve...

Oracle MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities

Binary data 9617.prm...

The YAWAST Antecedent Web Application Security Toolkit

The YAWAST Antecedent Web Application Security Toolkit YAWAST is an application meant to simplify initial analysis and information gathering for penetration testers and security auditors. It performs basic checks in these categories: TLS/SSL – Versions and cipher suites supported; common issues...

Micro Focus GroupWise Cross Site Scripting / Overflows

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Micro Focus GroupWise vulnerable version: GroupWise 2014 R2 =SP1 GroupWise 2014 unsupported versions may be affected fixed version:...

MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities

The version of MySQL running on the remote host is 5.7.x prior to 5.7.14. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. CVE-2016-3495,...

MySQL 5.7.x < 5.7.14 Multiple Vulnerabilities

The version of MySQL running on the remote host is 5.7.x prior to 5.7.14. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws exist in the InnoDB subcomponent that allow an authenticated, remote attacker to cause a denial of service condition. CVE-2016-3495,...

Someone is Spying on Researchers Behind VeraCrypt Security Audit

After TrueCrypt mysteriously discontinued itself, VeraCrypt became the most popular open source disk encryption software used by activists, journalists, and privacy conscious people. Due to the huge popularity of VeraCrypt, security researchers from the OSTIF The Open Source Technology Improvemen...

WordPress Security Audit Log Plugin <= 2.4.3 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in the "/wp-security-audit-log.php" file. Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

SQL Injection Vulnerability in minX Parameters of Zhongke Xinye Network Security Audit Platform

Zhongke Xinye Network Security Audit Platform is an Internet behavior analysis system. A SQL injection vulnerability exists in Zhongke Xinye Network Security Audit Platform due to the program not adequately filtering the minX parameter. An attacker is allowed to exploit the vulnerability to obtai...

Faraday v1.0.20 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday introduces a new concept - IPE Integrated Penetration-Test Environment a multiuser Penetration test IDE. Designed for distribution, indexation and analysis of the generated data during the process of a security audit. A brand new Faraday version is ready! Faraday v1.0.20 Community, Pro &...

Rough Auditing Tool for Security (RATS) 2.3 - Crash (PoC)

Exploit Title: RATS 2.3 Crash POC Date: 25th April 2016 Exploit Author: David Silveiro Author Contact: twitter.com/davidsilveiro Website: Xino.co.uk Software Link: https://code.google.com/archive/p/rough-auditing-tool-for-security/downloads Version: RATS 2.3 Tested on: Ubuntu 14.04 LTS CVE : 0 da...

FruityWifi v2.4 - Wireless Network Auditing Tool

FruityWifi is a wireless network auditing tool. The application can be installed in any Debian based system adding the extra packages. Tested in Debian, Kali Linux, Kali Linux ARM Raspberry Pi, Raspbian Raspberry Pi, Pwnpi Raspberry Pi, Bugtraq. v2.4 Utils have been added replaces "ifconfig -a"...

Lynis 2.2.0 - Security Auditing Tool for Unix/Linux Systems

Lynis is an open source security auditing tool. Commonly used by system administrators, security professionals and auditors, to evaluate the security defenses of their Linux/Unix based systems. It runs on the host itself, so it can perform very extensive security scans. Supported operating system...

Faraday 1.0.17 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday introduces a new concept - IPE Integrated Penetration-Test Environment a multiuser Penetration test IDE. Designed for distribution, indexation and analysis of the generated data during the process of a security audit. The first of many releases in 2016, Faraday v.1.0.17 Community, Pro &...

Ricochet — Most Secure Peer-to-Peer Encrypted Messenger that Sends No Metadata

There are several encrypted messaging apps for mobile and desktop platforms that shipped with "The Most Secure" tagline but ends up in de-anonymizing the real identity of its users in some or the other way. In fact, very few encrypted messaging apps available today deal with the core problem of...