Akeo Consulting Rufus fails to update itself securely

Overview Akeo Consulting Rufus fails to securely check for and retrieve updates, which an allow an authenticated attacker to execute arbitrary code on a vulnerable system. Description Akeo Consulting Rufus 2.16 retrieves updates over HTTP. While Rufus does attempt to perform some basic signature...

Wheeling Self-Driving Android App is vulnerable to arbitrary account password resets

Wheel Self-Driving APP is a self-driving comprehensive service center software. The Rolling Self-Driving Android APP is vulnerable to arbitrary account password reset vulnerability. It allows an attacker to reset any registered account password by means of CAPTCHA blasting...

Web-based OSINT and Active Reconnaissance Suite: D0xk1t

Active reconnaissance, information gathering and OSINT built in a portable web application. D0xk1t is an open-source , self-hosted and easy to use OSINT and active reconnaissance web application for penetration testers. Based off of the prior command-line script, D0xk1t is now fully capable of...

Installer and self-extracting archive containing the installer of "Security Setup Tool" may insecurely load Dynamic Link Libraries

Overview The installer and the self-extracting archive containing the installer of "Security Setup Tool" provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami of...

Oriental Resources Self-service Website - SQL Injection Vulnerability in Enterprise Website Management System

Enterprise Website Management System is an enterprise website based on PHP+MYSQL. An SQL injection vulnerability exists in Oriental Resources Self-service Website Builder - Enterprise Website Management System. The vulnerability is due to the system pkey parameter does not filter the data submitt...

Design/Logic Flaw

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

CVE-2014-3451

OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks...

Installer and self-extracting archive containing the installer of TDB CA TypeA use software may insecurely load Dynamic Link Libraries

Overview TDB CA TypeA use software provided by Teikoku Databank, Ltd. is a software which provides environment for using system and management function of TDB electronic authentication service TypeA. The installer and the self-extracting archive containing the installer of TDB CA TypeA use softwa...

JVN#18641169: Installer and self-extracting archive containing the installer of TDB CA TypeA use software may insecurely load Dynamic Link Libraries

TDB CA TypeA use software provided by Teikoku Databank, Ltd. is a software which provides environment for using system and management function of TDB electronic authentication service TypeA. The installer and the self-extracting archive containing the installer of TDB CA TypeA use software contai...

Confusing Self-Driving Cars by Altering Road Signs

Researchers found that they could confuse the road sign detection algorithms of self-driving cars by adding stickers to the signs on the road. They could, for example, cause a car to think that a stop sign is a 45 mph speed limit sign. The changes are subtle, though -- look at the photo from the...

Oracle Linux 7 : gnutls (ELSA-2017-2292)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2292 advisory. - Address crash in OCSP status request extension, by eliminating the unneeded parsing CVE-2017-7507, 1455828 Tenable has extracted the preceding...

Self-Driving Cars Can Be Hacked By Just Putting Stickers On Street Signs

Car Hacking is a hot topic, though it's not new for researchers to hack cars. Previously they had demonstrated how to hijack a car remotely, how to disable car's crucial functions like airbags, and even how to steal cars. But the latest car hacking trick doesn't require any extra ordinary skills ...

How to enable or disable self help portal in XenMobile server

This article provides instruction on how to enable or disable access to the Self Help Portal SHP...

Self-Driving Cars Can Be Tricked Into Misreading Street Signs

By Waqas We know that this is the age of smart gadgets This is a post from HackRead.com Read the original post: Self-Driving Cars Can Be Tricked Into Misreading Street Signs...

Fedora 25 : glpi (2017-2ec83f11c1)

various security fixes https://github.com/glpi-project/glpi/issues/2475, https://github.com/glpi-project/glpi/issues/2476, https://github.com/glpi-project/glpi/issues/2492, - fix regressions on self service portal : - self-service users should not be auto assigned as tech - type and category...

Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3376-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3376-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

Fedora 26 : glpi (2017-fd9d2dd019)

various security fixes https://github.com/glpi-project/glpi/issues/2475, https://github.com/glpi-project/glpi/issues/2476, https://github.com/glpi-project/glpi/issues/2492, - fix regressions on self service portal : - self-service users should not be auto assigned as tech - type and category...

Change Token Signing Certificate Expiration Date

When using ADFS 3.0, the Token-Signing Certificate that is generated during setup is, and can be, a Self-Signed Certificate. By default, the Token-Signing Certificate will expire 1 year after it is created. It will also automatically roll-over 2 weeks before expiration if Certification roll-over ...

Information Disclosure

Moodle is vulnerable to information disclosure. With self-registration enabled, a malicious user can retrieve another user's fullname if they know their username...

Lhaz+ Untrustworthy Search Path Vulnerability Vulnerability

Lhaz+ is a compression/decompression tool. An untrusted search path vulnerability exists in the Self-extracting archive file created in Lhaz+ 2.4.0 and earlier versions. An attacker can exploit this vulnerability to gain privileges with a malicious DLL in the directory...