CVE-2018-14608

Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectations because the data is directly accessible in cleartext. Specifically, it stores customer data in unique directories...

CVE-2018-14608

Thomson Reuters UltraTax CS 2017 for Windows is affected by CVE-2018-14608. The vulnerability stems from storing customer data in plaintext in unique directories under %install_path%\WinCSI\UT17DATA\client_ID\file_name.XX17, which can be bypassed without authentication by inspecting the strings i...

CVE-2018-14607

Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank account numbers in cleartext over SMBv2, which allows attackers to 1 obtain sensitive information by sniffing the network or 2 conduct man-in-the-middle MITM attacks via unspecified...

CVE-2018-14607

CVE-2018-14607/14608 apply to Thomson Reuters UltraTax CS 2017 for Windows in a client/server setup. The issue is that customer records and bank account numbers are transferred in cleartext over SMBv2, enabling network sniffing and potential MITM attacks; the disclosed data includes full names, S...

iamam.thomsonreuters.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-634067 Description| Value ---|--- Affected Website:| iamam.thomsonreuters.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Airba.sh - A POSIX-compliant, Fully Automated WPA PSK Handshake Capture Script Aimed At Penetration Testing

Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing. It is compatible with Bash and Android Shell tested on Kali Linux and Cyanogenmod 10.2 and uses aircrack-ng to scan for clients that are currently connected to access points AP. Those...

Git Remote Code Execution

Exploit Title: Git code execution Date: 2018-05-29 Exploit Author: JameelNabbo Website: jameelnabbo.com Vendor Homepage: https://github.com/git/git CVE: CVE-2018-11235 Version: =2.17.1 Tested on Kali Linux P0C: Create two files: pwned.sh: the file which will contain our commands to be executed...

tienda.thomsonreuters.com.pe XSS vulnerability

Open Bug Bounty ID: OBB-417782 Description| Value ---|--- Affected Website:| tienda.thomsonreuters.com.pe Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS...

Important: Red Hat Security Advisory: nss security update

An update for nss is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

thomson.co.uk XSS vulnerability

Vulnerable URL: http://www.thomson.co.uk/destinations/europe/portugal/algarve/olhos-dagua/hotels/sensimar-falesia-atlantic.html/1/%22%3E%3CsvG%20onLoad=alert%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 25.09.2017 Latest check for patch:| 25.09.2017 07:32 GMT...

Thomson TWG850 has multiple vulnerabilities

The Thomson TWG850 is a router product from Thomson Reuters USA. The Thomson TWG850 suffers from HTML injection, authentication bypass, and cross-site request forgery vulnerabilities. An attacker could use these vulnerabilities to steal cookie-based authentication, execute arbitrary code in an...

ip-science.thomsonreuters.com XSS vulnerability

Vulnerable URL:...

tax.thomsonreuters.com XSS vulnerability

Vulnerable URL: https://tax.thomsonreuters.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

japan.thomsonreuters.com XSS vulnerability

Vulnerable URL: http://japan.thomsonreuters.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

tax.thomsonreuters.com.au XSS vulnerability

Vulnerable URL: https://tax.thomsonreuters.com.au/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

press.thomson.co.uk XSS vulnerability

Vulnerable URL: http://press.thomson.co.uk/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6678...

thomson.co.uk XSS vulnerability

Vulnerable URL: http://www.thomson.co.uk/blog/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at 08.05.2017 Latest check for patch:| 08.05.2017 02:45 GMT Vulnerability type:| XSS Vulnerability status:| Public...

find.support.checkpoint.thomsonreuters.com XSS vulnerability

Vulnerable URL:...

Thomson Router TWG850-4U XSS / CSRF / Unauthenticated Access

System Affected Thomson Router HW Revision 2.0 VENDOR Thomson BOOT Revision 2.1.7i MODEL TWG850-4U Software Version ST9D.01.09 Serial Number 00939902404041 Firmware Name TWG850-4U-9D.01.09-100528-S-001.bin Vulnerabilities 1- Cross-Site Request Forgery 2- Unauthenticated access to resources 3-...

risk.thomsonreuters.com XSS vulnerability

Vulnerable URL: https://risk.thomsonreuters.com/search/node/%22/%3E%3CscRiPT%3Ealert%28%22XSSPOSED%22%29;%3C/scriPT%3E Details: Description| Value ---|--- Patched:| Yes, at 23.03.2017 Latest check for patch:| 23.03.2017 11:06 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...