PT-2018-15401 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS version 3.0 Description: An issue in S-CMS allows cross-site scripting XSS attacks via the T id parameter in the "admin/demo.php" API endpoint. Recommendations: For S-CMS version 3.0, avoid using the T id parameter in the "admin/demo.ph...

CVE-2018-20377

Orange Livebox 00.96.320S devices allow remote attackers to discover Wi-Fi credentials via /getgetnetworkconf.cgi on port 8080, leading to full control if the admin password equals the Wi-Fi password or has the default admin value. This is related to Firmware 01.11.2017-11:43:44, Boot v0.70.03,...

CVE-2018-20377

Orange Livebox ADSL modems (e.g., Arcadyan ARV7519RW22-A-L T VR9 1.2; firmware 00.96.320S) expose Wi‑Fi credentials via unauthenticated GET /get_getnetworkconf.cgi on port 8080. The underlying issue is information disclosure where the webserver returns the SSID and Wi‑Fi password in plaintext, en...

WSJ Webpage Defaced to Support PewDiePie

UPDATE A webpage owned by the Wall Street Journal was hacked on Monday, in an attempt to promote YouTube celebrity “PewDiePie.” The incident comes on the heels of a separate hack relating to the Swedish YouTuber, comedian and video game commentator, whose given name is Felix Kjellberg. Over the...

How Internet Savvy are Your Leaders?

Back in April 2015, I tweeted about receiving a letter via snail mail suggesting the search engine rankings for a domain registered in my name would suffer if I didn't pay a bill for some kind of dubious-looking service I'd never heard of. But it wasn't until the past week that it become clear ho...

Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801-s, 1801-t and 1801-u

Summary AT&T has released versions 1801-s, 1801-t and 1801-u for the Vyatta 5600. Details of this release can be found at https://console.bluemix.net/docs/infrastructure/virtual-router-appliance/vyatta-5600-security-fixes.htmlat-t-vyatta-5600-vrouter-software-patches Vulnerability Details CVEID:...

t-tools.nl XSS vulnerability

Open Bug Bounty ID: OBB-706756 Description| Value ---|--- Affected Website:| t-tools.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

YouTuber PewDiePie Promoted Via 50K Hacked Printers

A hacker claims to have commandeered 50,000 printers globally in order to print pamphlets promoting YouTube star “PewDiePie.” The alleged widespread hack sheds light on just how insecure printers are, and how precarious printer vulnerabilities could be when they offer an easy route into the...

Someone Hacked 50,000 Printers to Promote PewDiePie YouTube Channel

This may sound crazy, but it's true! The war for "most-subscribed Youtube channel" crown between T-Series and PewDiePie just took an interesting turn after a hacker yesterday hijacked more than 50,000 internet-connected printers worldwide to print out flyers asking everyone to subscribe to...

Someone Hacked 50,000 Printers to Promote PewDiePie YouTube Channel

This may sound crazy, but it's true! The war for "most-subscribed Youtube channel" crown between T-Series and PewDiePie just took an interesting turn after a hacker yesterday hijacked more than 50,000 internet-connected printers worldwide to print out flyers asking everyone to subscribe to...

t-correct.nl XSS vulnerability

Open Bug Bounty ID: OBB-699546 Description| Value ---|--- Affected Website:| t-correct.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...

Busting SIM Swappers and SIM Swap Myths

KrebsOnSecurity recently had a chance to interview members of the REACT Task Force, a team of law enforcement officers and prosecutors based in Santa Clara, Calif. that has been tracking down individuals engaged in unauthorized "SIM swaps" -- a complex form of mobile phone fraud that is often use...

Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801r

Summary Summary AT&T has released version 1801r for the Vyatta 5600. Advisory CVEs: CVE-2018-10860 CVE-2018-16741 CVE-2018-14618 CVE-2018-15473 CVE-2018-5391 CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682 Details of this release can be found at...

t-hr.hu XSS vulnerability

Open Bug Bounty ID: OBB-690970 Description| Value ---|--- Affected Website:| t-hr.hu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

CVE-2018-3197

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. The supported version that is affected is 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server...

Linux kernel KVM denial of service vulnerability (CNVD-2018-20467)

Linux kernel is the kernel used by the operating system Linux released by the Linux Foundation in the U.S. KVM is one of the kernel-based virtual machines. A security vulnerability exists in the t.c file of the KVM in versions of Linux kernel prior to 4.18.12 on the arm64 platform, which arises...

t-a-o.be XSS vulnerability

Open Bug Bounty ID: OBB-682094 Description| Value ---|--- Affected Website:| t-a-o.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

t-online.de XSS vulnerability

Open Bug Bounty ID: OBB-681033 Description| Value ---|--- Affected Website:| t-online.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-11241

An issue was discovered on SoftCase T-Router build 20112017 devices. A remote attacker can read and write to arbitrary files on the system as root, as demonstrated by code execution after writing to a crontab file. This is fixed in production builds as of Spring 2018...

CVE-2018-11240

An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' feature of the T-Router protocol. If the command syntax is correct, there is code execution both on the other modem and on the main servers. This is fixed in production builds as o...