Command Injection

Overview All versions of npm-programmatic are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the install, uninstall and list functions . This may allow attackers to execute arbitrary code in the system if the package name passe...

BWA DiREX-Pro Remote Code Execution Vulnerability

BWA Technology DiREX-Pro is a network video recorder from BWA Technology, Germany. A security vulnerability exists in BWA Technology DiREX-Pro version 1.2181. The vulnerability can be exploited by a remote attacker to execute arbitrary operating system commands by sending the 'PKG' parameter with...

Core FTP LE 2.2 - Denial of Service Exploit

Exploit Title: Core FTP LE 2.2 - Denial of Service PoC Exploit Author: Ismael Nava Vendor Homepage: http://www.coreftp.com/ Software Link: http://www.coreftp.com/download.html Version: 2.2 build 1947 Tested on: Windows 10 Home x64 CVE : n/a STEPS Open the program Core FTP LE In File select the...

DLLPasswordFilterImplant - DLL Password Filter Implant With Exfiltration Capabilities

DLLPasswordFilterImplant is a custom password filter DLL that allows the capture of a user's credentials. Each password change event on a domain will trigger the registered DLL in order to exfiltrate the username and new password value prior successfully changing it in the Active Directory AD. Fo...

CVE-2019-14514

An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup this is unrelated to Red Hat's systemd init program, and is a closed-source proprietar...

Intel® Renesas Electronics® USB 3.0 Driver Advisory

Summary: A potential security vulnerability in the Intel® Renesas Electronics® USB 3.0 Driver may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for this driver. Vulnerability Details: CVEID:...

Intel Renesas Electronics® USB 3.0 Driver Discontinuation - Lenovo Support US

Lenovo Security Advisory: LEN-30522 Potential Impact: Privilege escalation Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2020-0560 Summary Description: Intel has issued a Product Discontinuation notice for Intel® Renesas Electronics® USB 3.0 Driver due to a potential securit...

OS Command Injection

strapi is vulnerable to OS command injection. An attacker with administrative privileges is able to inject and execute arbitrary OS commands on the system via the install and uninstall plugins module due to a lack of validation in the plugin name...

Intel® SNMP Subagent Stand-Alone Advisory for Windows*

Summary: A potential security vulnerability in Intel® SNMP Subagent Stand-Alone for Windows may allow an escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for Intel® SNMP Subagent Stand-Alone for Window...

Uninstall ToTok, an Alleged Emirati Spy App, From Your Phone Now

A messaging app called ToTok had scores of positive reviews, particularly from users in the UAE. US intelligent officials say it may be spying for that government instead...

CVE-2019-19609

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function...

Strapi Admin Panel Install and Uninstall Plugin Component Remote Code Execution Vulnerability

Strapi is an open source headless content management system CMS. install and Uninstall Plugin is one of the install and uninstall plugin . A remote code execution vulnerability exists in the Install and Uninstall Plugin component of the Admin panel in Strapi, which stems from the program's failur...

Eset Mobile Security 5.2.18.0 Lock Bypass

Exploit Title: Bypassing Eset Mobile Security App Using Android's Split-Screen Feature Date: 11.11.2019 Exploit Author: Ferhat Cil linkedin:ferhatcil Vendor Homepage: Eset Version: 5.2.18.0 Tested on: Android 9.1.0.142, Android 8.1.0 Security App let's you lock your apps on your phone, but if you...

LenovoPaper Discontinuation - Lenovo Support US

No description provided...

LenovoPaper Discontinuation - US

Lenovo Security Advisory: LEN-29187 Potential Impact: Local Privilege Escalation Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2019-6191 Summary Description: A potential vulnerability reported in the discontinued LenovoPaper software may allow local privilege escalation...

AtomShields Cli - Security Testing Framework For Repositories And Source Code

AtomShields Cli is a Command-Line Interface to use the software AtomShields Installation pip install atomshieldscli Basic usage ascli --target --name The allowed action values are: install : To install a checker or a report, depending the context setted. uninstall : To uninstall a checker or a...

Getting "You might be having an issue with a Citrix virtual driver" while launching apps.

User's may see the following error message when launching applications or Desktops "Unable to Start, You might be having an issue with a Citrix virtual driver . Contact your system administrator for further assistance", where is the name of a 3rd Party application or driver eg MyBadApp. The issue...

Intel® Smart Connect Technology for Intel® NUC Advisory

Summary: A potential security vulnerability in Intel® Smart Connect Technology for Intel® NUC may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and is issuing a Product Discontinuation notice for Intel® Smart Connect Technology for Intel®...

WordPress ECPay Logistics for WooCommerce plugin <= 1.2.181030 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Ricardo Sanchez in WordPress ECPay Logistics for WooCommerce plugin versions = 1.2.181030. Solution 06 Sep 2019 - we were unable to find a patched version of this plugin. Deactivate and uninstall...

WARNING — Malware Found in CamScanner Android App With 100+ Million Users

Beware! Attackers can remotely hijack your Android device and steal data stored on it, if you are using free version of CamScanner, a highly-popular Phone PDF creator app with more than 100 million downloads on Google Play Store. So, to be safe, just uninstall the CamScanner app from your Android...