CVE-2019-12517

CVE-2019-12517 affects the WordPress SlickQuiz plugin prior to 1.3.7.1. The vulnerability arises from insufficient validation/sanitization in the save_quiz_score flow exposed via /wp-admin/admin-ajax.php, allowing unauthenticated users to submit quiz data that is stored in the database and later ...

3S-Smart Software Solutions GmbH CODESYS V3 Web Server

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: 3S-Smart Software Solutions GmbH Equipment: CODESYS V3 web server Vulnerabilities: Path Traversal, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities...

3S-Smart Software Solutions GmbH CODESYS V3 Products Containing a CODESYS Communication Server

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: 3S-Smart Software Solutions GmbH Equipment: CODESYS V3 products containing a CODESYS communication server Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this...

3S-Smart Software Solutions GmbH CODESYS Control V3 OPC UA Server

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: 3S-Smart Software Solutions GmbH Equipment: CODESYS Control V3 OPC UA Server Vulnerability: NULL Pointer Reference 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a...

Partner Perspectives: Endpoint Protection & Asset Management: Making Sure Everything That Should Be Protected, Is Protected

It’s a common refrain in cybersecurity: you can only protect what you can see. And while advances in endpoint protection technology have drastically increased the security of devices, organizations still struggle to understand which assets they have, and whether they’re properly covered by securi...

The “New” Easy Target:  State and Local Governments, Education

One of the “new” easy targets for cybercriminals are state governments, local governments and educational institutions. Over the past few months, we have seen several national news stories of cities, like Baltimore, that have been crippled by cybercrime, specifically ransomware attacks. However,...

SQL Server Password Changer 1.90 - Denial of Service

SQL Server Password Changer 1.90 - Denial of Service Exploit Title: SQL Server Password Changer v1.90 Denial of Service Exploit Date: 29.08.2019 Vendor Homepage:https://www.top-password.com/ Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam TwinTech Solutions Tested Version: v2.10 Tested...

SQL Server Password Changer 1.90 - Denial of Service

Exploit Title: SQL Server Password Changer v1.90 Denial of Service Exploit Date: 29.08.2019 Vendor Homepage:https://www.top-password.com/ Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam TwinTech Solutions Tested Version: v2.10 Tested on: Windows 8 x64 Windows 7 x64 1.- Run python code...

SQL Server Password Changer 1.90 - Denial of Service Exploit

Exploit Title: SQL Server Password Changer v1.90 Denial of Service Exploit Vendor Homepage:https://www.top-password.com/ Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam TwinTech Solutions Tested Version: v2.10 Tested on: Windows 8 x64 Windows 7 x64 1.- Run python code :Outlook Password...

SQL Server Password Changer 1.90 Denial Of Service

Exploit Title: SQL Server Password Changer v1.90 Denial of Service Exploit Date: 29.08.2019 Vendor Homepage:https://www.top-password.com/ Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam TwinTech Solutions Tested Version: v2.10 Tested on: Windows 8 x64 Windows 7 x64 1.- Run python code...

Outlook Password Recovery 2.10 - Denial of Service

Outlook Password Recovery 2.10 - Denial of Service Exploit Title: Outlook Password Recovery v2.10 Denial of Service Exploit Date: 16.08.2019 Vendor Homepage:https://www.top-password.com/ Software Link: https://www.top-password.com/outlook-password-recovery.html Exploit Author: Velayutham Selvaraj...

Outlook Password Recovery 2.10 - Denial of Service Exploit

Exploit Title: Outlook Password Recovery v2.10 Denial of Service Exploit Vendor Homepage:https://www.top-password.com/ Software Link: https://www.top-password.com/outlook-password-recovery.html Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam TwinTech Solutions Tested Version: v2.10...

Outlook Password Recovery 2.10 - Denial of Service

Exploit Title: Outlook Password Recovery v2.10 Denial of Service Exploit Date: 16.08.2019 Vendor Homepage:https://www.top-password.com/ Software Link: https://www.top-password.com/outlook-password-recovery.html Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam TwinTech Solutions Tested...

Atlassian Jira Cross-Site Request Forgery Vulnerability (CNVD-2019-30064)

Jira is a tool developed by Australian company Atlassian for defect tracking, issue tracking and project management. A cross-site request forgery vulnerability exists in the AddResolution.jspa resource in Jira. A remote attacker could exploit the vulnerability to create new solutions...

The Twists and Turns on the Road to Binee

On August 10, we introduced Binee—a binary emulation environment—to the world at DEFCON and, in an earlier blog, we shared a little bit of how and why we created this tool. Today, Binee is a tool that malware researchers can use as part of their reverse engineering processes. It’s an open-sourced...

Exploit for Cross-site Scripting in Oldstreetsolutions Live_Input_Macros

CVE-2019-15233 FAB-2019-00157 Vulnerability discoverd by me...

How Do Threats Align With Detection And Solutions?

There are many different threats targeting many different areas of a corporate network. Have you ever wondered how those threats are stopped? What threats impact which areas of a network? What technology detects and blocks those threats? I wanted to build an interactive graphic to answer those...

The Rise of “Bulletproof” Residential Networks

Cybercrooks increasingly are anonymizing their malicious traffic by routing it through residential broadband and wireless data connections. Traditionally, those connections have been mainly hacked computers, mobile phones, or home routers. But this story is about so-called "bulletproof residentia...

How Axonius integrates with Microsoft to help customers solve the cybersecurity asset management challenge

Despite the amazing and futuristic progression of technologies in cybersecurity, it's still incredibly hard to answer the most basic of questions like: how many assets do I have, and do they adhere to my security policy? Somewhere along the line, asset management became very mundane compared to t...

NIST Publishes Multifactor Authentication Practice Guide

The National Institute of Standards and Technology NIST National Cybersecurity Center of Excellence NCCoE has published NIST Cybersecurity Practice Guide: Multifactor Authentication for E-Commerce. The guide provides e-commerce organizations multifactor authentication MFA protection methods they...