CVE-2018-18390

User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18396

The CVE-2018-18396 entry concerns Moxa ThingsPro IIoT Gateway and Device Management Software Solutions, version 2.1. Multiple connected sources (CNVD-2018-21513, NVD, and related records) authorize a Remote Code Execution vulnerability in this product. The root cause is an ability for a remote at...

CVE-2018-18392

CVE-2018-18392 describes a privilege escalation due to broken access control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions, version 2.1. Affected component is the ThingsPro product suite; the root cause is improper access control allowing elevation of privileges. Impact ...

CVE-2018-18390

CVE-2018-18390 affects Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. Connected sources describe a user enumeration vulnerability over the network, with CNVD noting a remote attacker could use brute-force attempts to obtain a valid user password. The CVSS metric...

CVE-2018-18392

Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18395

CVE-2018-18395 affects Moxa ThingsPro IIoT Gateway and Device Management Software Solutions v2.1. A vulnerability described as Hidden Token Access exists, with CNVD reporting that a remote attacker could gain root privileges and execute arbitrary code via a hidden API token. The CVE’s CVSS scores...

CVE-2018-18395

Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18394

Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18391

User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18391

CVE-2018-18391 affects Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1. The connected documents describe a user privilege escalation vulnerability in ThingsPro, but do not specify the underlying root cause, affected components, or concrete exploitation details. Pu...

CVE-2018-18393

Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

Is FIDO the future instrument to prove our identity?

FIDO, short for Fast IDentity Online, is an industry consortium started in 2013 to address the lack of interoperability among strong authentication devices and the problems users face creating and remembering multiple usernames and passwords. Among the founders were those who work in the financia...

ThreatList: Microsoft IIS Sees Triple-Digit Spike in Cyberattack Volume

Internet Information Services IIS, an extensible web server originally created by Microsoft for use with the Windows NT family, saw a whopping 782x increase in cyberattacks during the second quarter, according to analysis. According to eSentire’s latest threat report based on data gathered from...

PT-2018-34: XXE Injection in S3 Browser

The specialists of the Positive Research center have detected an XXE Injection vulnerability in S3 Browser. A vulnerability in the HTTP-based S3 protocol, due to server responses transmitted in XML format, allows remote attackers to read user files and obtain NTLMv2 hash values by tricking a user...

centurybusinesssolutions.com XSS vulnerability

Open Bug Bounty ID: OBB-683833 Description| Value ---|--- Affected Website:| centurybusinesssolutions.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

2018 Flare-On Challenge Solutions

We are pleased to announce the conclusion of the fifth annual Flare-On Challenge. The numbers are in and we can safely say that this was by far the most difficult challenge we’ve ever hosted. We plan to reduce the difficulty next year, so it may be that the 114 people who solved this year’s...

Fileless malware: part deux

In part one of this series, we focused on an introduction to the concepts fileless malware, providing examples of the problems that we in the security industry face when dealing with these types of attacks. In part two, I will be walking through a few demonstrations of fileless malware attacks th...

ramsonsolutions.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-682824 Description| Value ---|--- Affected Website:| ramsonsolutions.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:|...

China Chip Hack Shines Spotlight on Hardware and Supply-Chain Risk

Recent revelations in the press regarding hardware implants and supply-chain compromise are troubling and should be seen as an opportunity to assess our current threat model and security approach. This recently revealed situation is the hardware analogue to the software supply chain compromises w...

Cb Integrations: Cb Response Timeliner

Editor's Note: This post originally appeared on StillzTech.com and is being republished with permission from the author. Github: Incident Response is a challenging career. As responders, we must do our best to keep up to date with the latest attack trends, malware and forensic techniques...