CVE-2018-14608

Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectations because the data is directly accessible in cleartext. Specifically, it stores customer data in unique directories...

CVE-2018-14607

CVE-2018-14607/14608 apply to Thomson Reuters UltraTax CS 2017 for Windows in a client/server setup. The issue is that customer records and bank account numbers are transferred in cleartext over SMBv2, enabling network sniffing and potential MITM attacks; the disclosed data includes full names, S...

CVE-2018-14607

Thomson Reuters UltraTax CS 2017 on Windows, in a client/server configuration, transfers customer records and bank account numbers in cleartext over SMBv2, which allows attackers to 1 obtain sensitive information by sniffing the network or 2 conduct man-in-the-middle MITM attacks via unspecified...

CVE-2018-14608

Thomson Reuters UltraTax CS 2017 for Windows is affected by CVE-2018-14608. The vulnerability stems from storing customer data in plaintext in unique directories under %install_path%\WinCSI\UT17DATA\client_ID\file_name.XX17, which can be bypassed without authentication by inspecting the strings i...

CVE-2018-14608

Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectations because the data is directly accessible in cleartext. Specifically, it stores customer data in unique directories...

iamam.thomsonreuters.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-634067 Description| Value ---|--- Affected Website:| iamam.thomsonreuters.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Airba.sh - A POSIX-compliant, Fully Automated WPA PSK Handshake Capture Script Aimed At Penetration Testing

Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing. It is compatible with Bash and Android Shell tested on Kali Linux and Cyanogenmod 10.2 and uses aircrack-ng to scan for clients that are currently connected to access points AP. Those...

Git Remote Code Execution

Exploit Title: Git code execution Date: 2018-05-29 Exploit Author: JameelNabbo Website: jameelnabbo.com Vendor Homepage: https://github.com/git/git CVE: CVE-2018-11235 Version: =2.17.1 Tested on Kali Linux P0C: Create two files: pwned.sh: the file which will contain our commands to be executed...

tienda.thomsonreuters.com.pe XSS vulnerability

Open Bug Bounty ID: OBB-417782 Description| Value ---|--- Affected Website:| tienda.thomsonreuters.com.pe Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS...

Important: Red Hat Security Advisory: nss security update

An update for nss is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

thomson.co.uk XSS vulnerability

Vulnerable URL: http://www.thomson.co.uk/destinations/europe/portugal/algarve/olhos-dagua/hotels/sensimar-falesia-atlantic.html/1/%22%3E%3CsvG%20onLoad=alert%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 25.09.2017 Latest check for patch:| 25.09.2017 07:32 GMT...

Thomson TWG850 has multiple vulnerabilities

The Thomson TWG850 is a router product from Thomson Reuters USA. The Thomson TWG850 suffers from HTML injection, authentication bypass, and cross-site request forgery vulnerabilities. An attacker could use these vulnerabilities to steal cookie-based authentication, execute arbitrary code in an...

ip-science.thomsonreuters.com XSS vulnerability

Vulnerable URL:...

tax.thomsonreuters.com XSS vulnerability

Vulnerable URL: https://tax.thomsonreuters.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

japan.thomsonreuters.com XSS vulnerability

Vulnerable URL: http://japan.thomsonreuters.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

tax.thomsonreuters.com.au XSS vulnerability

Vulnerable URL: https://tax.thomsonreuters.com.au/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

press.thomson.co.uk XSS vulnerability

Vulnerable URL: http://press.thomson.co.uk/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6678...

thomson.co.uk XSS vulnerability

Vulnerable URL: http://www.thomson.co.uk/blog/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at 08.05.2017 Latest check for patch:| 08.05.2017 02:45 GMT Vulnerability type:| XSS Vulnerability status:| Public...

find.support.checkpoint.thomsonreuters.com XSS vulnerability

Vulnerable URL:...

Thomson Router TWG850-4U XSS / CSRF / Unauthenticated Access

System Affected Thomson Router HW Revision 2.0 VENDOR Thomson BOOT Revision 2.1.7i MODEL TWG850-4U Software Version ST9D.01.09 Serial Number 00939902404041 Firmware Name TWG850-4U-9D.01.09-100528-S-001.bin Vulnerabilities 1- Cross-Site Request Forgery 2- Unauthenticated access to resources 3-...