“Breaking Bad Security” – Tutorial 2 – Remote Access

Welcome to the second tutorial from our video series, “Breaking Bad Security!” This security series is designed to inform you about different tests, tricks, and free tools you can use to validate your security controls to ensure your environment is secure. In this series, we will provide...

Wikileaks Unveils Project Protego: CIA's Secret Missile Control System

Every week since March Wikileaks has been leaking secrets from the United States Central Intelligence Agency CIA, which mainly focus on surveillance techniques and hacking tools employed by its agents. However this time, the whistleblower organisation has released something different from its...

Apple Safari Technology Preview WebKit Input Validation Vulnerability

Apple Safari Technology Preview is a browser from Apple.WebKit is an open source web browser engine developed by the KDE community and currently used by Apple Safari and Google Chrome. A security vulnerability exists in the runtime/JSONObject.cpp file of WebKit's JavaScriptCore in Apple Safari...

Denial of Service Vulnerability in EZZY APP for Android

EZZY APP is a car intelligent sharing platform APP created by Beijing Daimeng Technology Co. A denial of service vulnerability exists in the Android version of EZZY APP, which allows an attacker to traverse a cell phone number and consume server resources by sending an unlimited number of...

Incapsula Updated Review — New Security Options, Improved Delivery and Reliability

It's been close to five years since we last looked at Incapsula, a security-focused CDN service known for its DDoS mitigation and web application security features. As one would expect, during these five years the company has expanded and improved, introducing lots of new features and even severa...

Code injection

Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollback will not prevent upgrading to firmware version 11.6.x.1xxx which is vulnerable to CVE-2017-5689 and can be performed by a local user...

CVE-2017-5698

Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollback will not prevent upgrading to firmware version 11.6.x.1xxx which is vulnerable to CVE-2017-5689 and can be performed by a local user...

FiberHome ADSL AN1020-25 - Improper Access Restrictions

Title: ==== FiberHome Unauthenticated ADSL Router Factory Reset. Credit: ====== Name: Ibad Shah Twitter: @BeeFaauBee09 Website: beefaaubee09.github.io CVE: ===== CVE-2017-14147 Date: ==== 05-09-2017 dd/mm/yyyy About FiberHome: ====== FiberHome Technologies is a leading equipment vendor and global...

PT-2017-16678 · Intel · Intel Active Management Technology +2

Name of the Vulnerable Software and Affected Versions: Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business...

Intel AMT® Upgradable to Vulnerable Firmware

Summary: Intel® Active Management Technology, Intel® Standard Manageability, and Intel® Small Business Technology firmware versions 11.0.25.3001 and 11.0.26.3000 anti-rollback will not prevent upgrading to firmware version 11.6.x.1xxx which is vulnerable to CVE-2017-5689 and can be performed by a...

Wenzhou Starlight Technology Development Co., Ltd. website builder system newLook.asp page SQL injection vulnerability

Wenzhou Starlight Technology Development Co., Ltd. website builder is a website builder system. There is a SQL injection vulnerability in the newLook.asp page of the website builder system of Wenzhou Starlight Technology Development Co. The vulnerability is due to the system fails to effectively...

Tulpar - Web Vulnerability Scanner

Tulpar is a open source web vulnerability scanner for written to make web penetration testing automated. Features Sql Injection GET Method XSS GET Method Crawl E-mail Disclosure Credit Card Disclosure Whois Command Injection GET Method Directory Traversal GET Method File Include GET Method Server...

There are multiple vulnerabilities in IBM SDK Java Technology Edition

IBM SECURITY ADVISORY First Issued: Fri Sep 1 08:58:20 CDT 2017 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/javajuly2017advisory.asc https://aix.software.ibm.com/aix/efixes/security/javajuly2017advisory.asc...

Intel Confirms Its Much-Loathed ME Feature Has A Kill Switch

Researchers at Positive Technologies forced Intel’s hand at revealing that a previously undocumented kill switch exists for its oft-criticized Intel Management Engine, a remote management component of Intel CPUs. Initially, Positive Technologies set out to disable the feature that some security...

SQL Injection Vulnerability in Ju Teng Technology's Website Building System

Ju Teng Technology website building system is an enterprise website building system. SQL injection vulnerability exists in the Ju Teng Technology website builder system/product.php?pid= page, which can be exploited by attackers to obtain sensitive information from the database...

Denial of Service Vulnerability in Storm Video 5

Storm Video 5 is the video playback software of Beijing Storm Technology Co. Storm Video 5 decoder has a denial of service vulnerability when decoding special mp4 files, which can be exploited by attackers to cause the software to crash, resulting in a denial of service...

Is Your Mobile Carrier Your Weakest Link?

More online services than ever now offer two-step authentication -- requiring customers to complete a login using their phone or other mobile device after supplying a username and password. But with so many services relying on your mobile for that second factor, there has never been more riding o...

Shenzhen Yuanzheng Technology goloZ Android APP has arbitrary account password reset vulnerability

goloZ APP is a product developed by Shenzhen Yuanzheng Technology to provide auto repair service. There is an arbitrary account password reset vulnerability in Shenzhen Yuanzheng Technology's goloZ Android APP. An attacker can reset any registered user's password by CAPTCHA blasting...

SQL Injection Vulnerability in Infinite Streaming Media System (AMS) of Beijing Zhongshi Media Technology Co.

Infinite Streaming Media System AMS is a complete set of IP network-based audio/video application platform, integrating CTVTV's live video broadcasting system, video-on-demand VOD system, video broadcasting system and video production sub-systems, aiming to provide users with a complete set of...

Shenzhen Yuanzheng Technology X431-PRO 3S Android APP has an overstepping vulnerability

X431-PRO 3S APP is a vehicle fault detection system. The X431-PRO 3S Android APP of Shenzhen Yuanzheng Technology has an overstepping vulnerability. The attacker logs into the system and modifies the user ID by grabbing packets to view any account information, including: user name, cell phone...