Path traversal

An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of...

CVE-2017-6051

The CVE-2017-6051 entry concerns BLF-Tech LLC VisualView HMI, affected in versions 9.9.14.0 and earlier. The issue is an Uncontrolled Search Path Element (CWE-427) vulnerability that may allow a local attacker to cause execution of arbitrary code by loading a malicious DLL from the search path. C...

CVE-2017-6051

An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of...

On the Google Docs Phishing Attack, Intel AMT, and Drone Security

Mike Mimoso and Chris Brook discuss the news of the week, including the Gmail/Google Docs phishing attack, the Intel AMT vulnerability, IBM’s malware-laden USB drives, and drone security. Download: ThreatpostNewsWrapMay52017.mp3 Music by Chris Gonsalves...

BLF-Tech LLC VisualView HMI Local Code Execution Vulnerability

BLF-Tech LLC VisualView HMI is a human-machine interface interaction program from BLF-Tech LLC. BLF-Tech LLC VisualView HMI has a security vulnerability that allows a local attacker to exploit the vulnerability special request to execute arbitrary code and elevate privileges...

BLF-Tech LLC VisualView HMI

CVSS v3 7.0 ATTENTION: Low skill level to exploit Vendor: BLF-Tech LLC Equipment: VisualView HMI Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following VisualView HMI versions are affected: VisualView HMI Version 9.9.14.0 and prior. IMPACT Successful exploitation of this...

First Tech Federal CU - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application First Tech Federal CU published at the 'play' market has multiple vulnerabilities...

XM tech security monitoring equipment, pre-uc-httpd server causes the presence of any directory traversal and local file inclusion vulnerabilities

0x01 vulnerability overview 1, the vendor information Manufacturer name: XM tech Official domain name: www.xiongmaitech.com Hangzhou XM Information Technology Co., Ltd. specialize in security monitoring, intelligent video independent research and development dedicated to security video monitoring...

FreeBSD : id Tech 3 -- remote code execution vulnerability (e48355d7-1548-11e7-8611-0090f5f2f347)

The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks...

FIVE MINUTES WITH: Judy Piper, Senior Engineering Manager, Akamai's Enterprise & Carrier Division

No matter what else she does in her day, Judy Piper is, first and foremost, a people manager. Her role as a senior engineering manager in the Enterprise business unit is all about empowering others, and her curiosity and fearlessness help her succeed. Judy recently answered a few questions about...

WikiLeaks Won't Disclose CIA Exploits To Companies Until Certain Demands Are Met

It's been over a week since Wikileaks promised to hand over more information on hacking tools and tactics of the Central Intelligence Agency CIA to the affected tech companies, following a leak of a roughly 8,761 documents that Wikileaks claimed belonged to CIA hacking units. "We have decided to...

CVE-2017-6903

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...

Security feature bypass

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...

CVE-2017-6903

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...

UBUNTU-CVE-2017-6903

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...

CVE-2017-6903

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...

CVE-2017-6903

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...

id Tech 3 -- remote code execution vulnerability

The content auto-download of id Tech 3 can be used to deliver maliciously crafted content, that triggers downloading of further content and loading and executing it as native code with user credentials. This affects ioquake3, ioUrbanTerror, OpenArena, the original Quake 3 Arena and other forks...

Car Workshop System - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Car Workshop System - SQL Injection Google Dork: N/A Date: 13.03.2017 Vendor Homepage: http://prosoft-apps.com/ Software: https://codecanyon.net/item/car-workshop-system/19562074 Demo: http://workshop.prosoft-apps.com/ Version:...

Car Workshop System SQL Injection

Exploit Title: Car Workshop System - SQL Injection Google Dork: N/A Date: 13.03.2017 Vendor Homepage: http://prosoft-apps.com/ Software: https://codecanyon.net/item/car-workshop-system/19562074 Demo: http://workshop.prosoft-apps.com/ Version: N/A Tested on: Win7 x64, Kali Linux x64 Exploit Author...