Geutebruck re_porter 16 Credential Disclosure

Exploit Title: Geutebruck reporter 16 Credentials Disclosure Date: 03-08-2018 Exploit Author: Kamil Suska Vendor Homepage: https://www.geutebrueck.com//media/public/products/descriptionsarchive/en/reporterecon7.74007IADEENFRES.pdf Version: prior 7.8.974.20 CVE-2018-15534 GET...

Ed: Physical Laptop Takeover

At 6:16PM of August 11th of 2018, during H1-702, right before the sand storm beat the shit out of the rooftop party, we managed to perform a critical attack on Ed's infrastructure. F332214 Report Summary During our analysis and reconnaissance of how Ed program worked during the h1-702 event, we...

Qualys BrowserCheck CoinBlocker Protects Users From Active Cryptojacking Campaigns

Qualys Malware Research Labs recently released the Qualys BrowserCheck CoinBlocker Chrome Extension. We have seen enthusiastic adoption from users across the globe in the first week since its release, which has given us enough telemetry data to indicate success in protecting users from popular...

libreoffice/wksfuzzer: NULL

Detailed report: https://oss-fuzz.com/testcase?key=5113178655555584 Project: libreoffice Fuzzer: libFuzzerlibreofficewksfuzzer Fuzz target binary: wksfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: NULL Sanitizer: undefined...

Monitoring NetScaler SD-WAN Network/System

Complete the following steps to monitor statistics related to Network interfaces and System statistics like CPU/Memory: Under Monitoring - Appliance Reports SubSystem / Network / System You can monitor Traffic/Errors/Packet drops at Interface level Load Average Network Status Check CPU and Memory...

Camelishing - Social Engineering Tool

Camelishing Social Engineering Tool Features 1. Bulk email sending 2. Basic Python Agent Creator 3. Office Excel Macro Creator 4. DDE Excel Creatoror Custom Payload 5. Return İnformation Mail Open Track Agent Open Track 6. AutoSave 7. Statistics Report 8. User Control Installation Modules $ pip...

PrestaShop < 1.6.1.19 - BlowFish ECD Privilege Escalation Exploit

Exploit for php platform in category web applications !/usr/bin/env python3 PrestaShop = 1.6.1.19 Privilege Escalation Charles Fol 2018-07-10 See https://ambionics.io/blog/prestashop-privilege-escalation The condition for this exploit to work is for an employee to have the same password as a...

PrestaShop 1.6.1.19 - BlowFish ECD Privilege Escalation

PrestaShop 1.6.1.19 - BlowFish ECD Privilege Escalation !/usr/bin/env python3 PrestaShop = 1.6.1.19 Privilege Escalation Charles Fol 2018-07-10 See https://ambionics.io/blog/prestashop-privilege-escalation The condition for this exploit to work is for an employee to have the same password as a...

PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation

!/usr/bin/env python3 PrestaShop = 1.6.1.19 Privilege Escalation Charles Fol 2018-07-10 See https://ambionics.io/blog/prestashop-privilege-escalation The condition for this exploit to work is for an employee to have the same password as a customer. The exploit will yield a valid employee cookie f...

WordPress WP Statistics < 12.0.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:veronalabs:wpstatistics"; ifdescription...

Security Bulletin: Multiple vulnerabilities in the zlib component affect IBM SPSS Statistics (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843)

Summary There are multiple vulnerabilities in the zlib component used by IBM SPSS Statistics Version 21, 22, 23, and 24. Vulnerability Details CVEID: CVE-2016-9840 DESCRIPTION: zlib is vulnerable to a denial of service, caused by an out-of-bounds pointer arithmetic in inftrees.c. By persuading a...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics (CVE-2016-5548, CVE-2016-5549, CVE-2016-5547, CVE-2016-2183)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6, 7.0, 7.1, and 8.0 used by IBM SPSS Statistics Version 21, 22, 23, and 24. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017. Vulnerability Details CVEID: CVE-2016-5548 DESCRIPTION: An...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM SPSS Statistics (CVE-2016-3485)

Summary A vulnerability in IBM® Runtime Environment Java™ Version 6.0, 7.0, 7.1, and 8.0 that is used by IBM SPSS Statistics. This issue was disclosed as part of the IBM Java SDK updates in July 2016. Vulnerability Details CVEID: CVE-2016-3485 DESCRIPTION: An unspecified vulnerability related to...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics (CVE-2015-4872, CVE-2015-4734, CVE-2015-5006, CVE-2015-7575)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 1.6 and 1.7 that is used by IBM SPSS Statistics. These issues were disclosed as part of the IBM Java SDK updates in October 2015 and includes the vulnerability commonly referred to as “SLOTH”...

Security Bulletin: DH Key Exchange protocol vulnerability (“Logjam”) affects SPSS Data Access Pack

Summary TLS connections using Diffie-Hellman DH key exchange protocol affects IBM SPSS Data Accesss Pack 7.1.1. This attack has been referred to as "Logjam" in various sources. IBM SPSS Data Access Pack is a software component used by IBM SPSS Statistics and IBM SPSS Modeler. Vulnerability Detail...

Security Bulletin: DH key exchange protocol vulnerability (“Logjam”) in IBM Java SDK affects IBM SPSS Statistics (CVE-2015-4000)

Summary TLS connections using Diffie-Hellman DH key exchange protocol, “Logjam” attack, affects IBM Java SDK 1.6, 1.7 that is used by IBM SPSS Statistics. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused...

PvPGN Stats SQL Injection Vulnerability

PvPGN Stats is a PHP-based tool that supports the integration of websites with the PvPGN game server, displaying server status, ladder pages, and more. A SQL injection vulnerability exists in the ladder/stats.php file in PvPGN Stats version 2.4.6, which stems from the program failing to filter...

CVE-2017-18290

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sortdirection parameter...

WordPress Feed-Statistics Plugin Open Redirect Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL.Feed-Statistics is one of the editorial statistics through the Feed reader about the people who are readi...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15879)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the getstoragegroupstatistics method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker can exploit this vulnerability to execute system commands via the...