Halon Security Router (SR) 3.2-winter-r1 - Multiple Vulnerabilities

Halon Security Router SR 3.2-winter-r1 - Multiple Vulnerabilities ADVISORY INFORMATION Advisory Name: Multiple Security Vulnerabilities in Halon Security Router Date published: 2014-04-07 Vendors contacted: Halon Security http://www.halon.se Researcher: Juan Manuel Garcia...

PT-2014-3576

Analytics Top-10 exploited vulnerabilities in January-July 2020: 1. MVPower DVR Remote Code Execution 2. Dasan GPON Router Authentication Bypass CVE-2018-10561 3. OpenSSL TLS DTLS Heartbeat Information Disclosure CVE-2014-0160; CVE-2014-0346 4. HTTP Headers Remote Code Execution CVE-2020-13756 5...

JBoss Status Servlet Information Gathering

This module queries the JBoss status servlet to collect sensitive information, including URL paths, GET parameters and client IP addresses. This module has been tested against JBoss 4.0, 4.2.2 and 4.2.3. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2014-2077

Cross-site scripting XSS vulnerability in the frontend in Open-Xchange OX AppSuite 7.4.1 before 7.4.1-rev10 and 7.4.2 before 7.4.2-rev8 allows remote attackers to inject arbitrary web script or HTML via the subject of an email, involving 'the aria "tags" for screenreaders at the top bar'...

AT&T Cross Site Scripting

. / \ | |/ / / /\ | |\ \ / | \ |/ \ | // / / / Corporation 2014 c Published Report: 27/02/2014 Credits: Advanced Information Security Corporation, USA Severity: High/Critical OWASP TOP 10 Type: Web Application / Cross-Site Scripting . CVSS: 7.0 Author: Nicholas Lemonias. Information Security...

British Sky Broadcasting Group Cross Site Scripting

. / \ | |/ / / /\ | |\ \ / | \ |/ \ | // / / / Corporation c 2014 Published Report: 25/02/2014 Credits: Advanced Information Security Corporation, USA Severity: Critical Type: Web Application / Reflected Cross-site scripting attack. CVSS: 7.0 , OWASP TOP 10 Author: Nicholas Lemonias. Background...

Visa Europe Cross Site Scripting

Visa Europe Official Website Vulnerability ============================================= Published Report: 07/02/2014 Credits: Advanced Information Security Corporation, USA Severity: High/Critical OWASP TOP 10 CVSS: 7.0 Type: Web Application / Reflected Cross-Site Scripting Attack. Author:...

CVE-2014-0669: Undefined Security Weakness

The Wireless Session Protocol WSP feature in the Gateway GPRS Support Node GGSN component on Cisco ASR 5000 series devices allows remote attackers to bypass intended Top-Up payment restrictions via unspecified WSP packets, aka Bug ID CSCuh28371...

[CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application

Title: CVE-2014-0647 Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application Published: January 13, 2014 Reported to Vendor: December 2013 no direct response CVE Reference: CVE-2014-0647 Credit: This issue was discovered by Daniel E. Wood...

Starbucks 2.6.1 Information Disclosure

Title: CVE-2014-0647 Insecure Data Storage of User Data Elements in Starbucks v2.6.1 iOS mobile application Published: January 13, 2014 Reported to Vendor: December 2013 no direct response CVE Reference: CVE-2014-0647 Credit: This issue was discovered by Daniel E. Wood...

[Websecurify] Web Security Testing Runtime

A Complete Suite Of Web Security Tools The Suite provides a complete and functional marketplace of highly integrated web application security tools. You will find that different areas are covered by various domain-specific solutions. The Suite consists of automated scanners, fuzzers, utilities an...

Linux worm targeting Routers, Set-top boxes and Security Cameras with PHP-CGI Vulnerability

A Symantec researcher has discovered a new Linux worm, targeting machine-to-machine devices, and exploits a PHP vulnerability CVE-2012-1823 to propagate that has been patched as far back as May 2012. Linux worm, which has been dubbed Linux.Darlloz, poses a threat to devices such as home routers a...

Linux worm targeting Routers, Set-top boxes and Security Cameras with PHP-CGI Vulnerability

None...

NSA Crypto Questions Resemble a 'Hall of Mirrors'

There’s been no shortage of discussion and debate in recent week about the possibility that the NSA has intentionally weakened some cryptographic algorithms and cipher suites in order to give it an advantage in its intelligence-gathering operations. If you subscribe to the worst-case scenario lin...

Cybozu Office vulnerable to cross-site scripting

Overview Cybozu Office is a groupware. Cybozu Office contains a cross-site scripting vulnerability in the function to customize the top page. Motoki Nishio of VALTES CO.,LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

CVE-2013-4703: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the top-page customization feature in Cybozu Office before 9.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-5147

Name of the Vulnerable Software and Affected Versions Cybozu Office versions prior to 9.3.1 Description A cross-site scripting XSS issue exists in the top-page customization feature, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized...

CVE-2013-2804

The DNP Master Driver in Software Toolbox TOP Server before 5.12.140.0 allows remote attackers to cause a denial of service master-station infinite loop via crafted DNP3 packets to TCP port 20000 and allows physically proximate attackers to cause a denial of service master-station infinite loop v...

CVE-2013-2804

CVE-2013-2804 affects Software Toolbox TOP Server DNP Master Driver (OPC Server) on Windows, before version 5.12.140.0. Root cause: improper input validation that allows crafted DNP3 traffic to TCP port 20000 or crafted input over serialization to cause the master to enter an infinite loop and cr...

KLA10357 DoS vulnerability in TOP Server

An unspecified vulnerability was found in the TOP Server. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited locally via a specially designed input. Original advisories - Exploitation Related products TOP-Server CVE list CVE-2013-2804...