🕴 Sodin Ransomware Exploits Windows Privilege Escalation Bug 🕴
📖 Read
via "Dark Reading: ".
Exploitation of CVE-2018-8453 grants attackers the highest level of privileges on a target system.📖 Read
via "Dark Reading: ".
Darkreading
Sodin Ransomware Exploits Windows Privilege Escalation Bug
Exploitation of CVE-2018-8453 grants attackers the highest level of privileges on a target system.
ATENTION‼ New - CVE-2017-9327
📖 Read
via "National Vulnerability Database".
Secret data of processes managed by CM is not secured by file permissions.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-9326
📖 Read
via "National Vulnerability Database".
The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manager. The keystore file itself is not exposed.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-9325
📖 Read
via "National Vulnerability Database".
The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-6900
📖 Read
via "National Vulnerability Database".
An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass, the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to this, VAL0 and VAL1 should be sanitised to ensure they do not contain malicious characters. Passing it the username of '-' will cause it to time out and log the user in because of poor error handling. This will log the attacker in as an administrator where the telnet / ssh services can be enabled, and the credentials for local users can be reset. Also, login.cgi accepts the username as a GET parameter, so login can be achieved by browsing to the /cgi-bin/login.cgi?username=-%20a URI.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-6216
📖 Read
via "National Vulnerability Database".
novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code execution📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-18346
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows remote attackers to execute arbitrary SQL commands via the wbg_login parameter.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-17972
📖 Read
via "National Vulnerability Database".
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362.📖 Read
via "National Vulnerability Database".
🕴 New 'WannaHydra' Malware a Triple Threat to Android 🕴
📖 Read
via "Dark Reading: ".
The latest variant of WannaLocker is a banking Trojan, spyware tool, and ransomware.📖 Read
via "Dark Reading: ".
Darkreading
New 'WannaHydra' Malware a Triple Threat to Android
The latest variant of WannaLocker is a banking Trojan, spyware tool, and ransomware.
🕴 US Military Warns Companies to Look Out for Iranian Outlook Exploits 🕴
📖 Read
via "Dark Reading: ".
Microsoft patched a serious vulnerability in the Microsoft Outlook client in 2017, but an Iranian group continues to exploit the flaw.📖 Read
via "Dark Reading: ".
Darkreading
US Military Warns Companies to Look Out for Iranian Outlook Exploits
Microsoft patched a serious vulnerability in the Microsoft Outlook client in 2017, but an Iranian group continues to exploit the flaw.
ATENTION‼ New - CVE-2017-8230
📖 Read
via "National Vulnerability Database".
On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security analysis it was identified that a low privileged user who belongs to the "user" group and who has access to login in to the web administrative interface of the device can add a new administrative user to the interface using HTTP APIs provided by the device and perform all the actions as an administrative user by using that account. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable functions that performs the various action described in HTTP APIs. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function at address 0x00429084 in IDA pro is the one that processes the HTTP API request for "addUser" action. If one traces the calls to this function, it can be clearly seen that the function sub_ 41F38C at address 0x0041F588 parses the call received from the browser and passes it to the "addUser" function without any authorization check.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-8229
📖 Read
via "National Vulnerability Database".
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function sub_436D6 in IDA pro is identified to be setting up the configuration for the device. If one scrolls to the address 0x000437C2 then one can see that /current_config is being set as an ALIAS for /mnt/mtd/Config folder on the device. If one TELNETs into the device and navigates to /mnt/mtd/Config folder, one can observe that it contains various files such as Account1, Account2, SHAACcount1, etc. This means that if one navigates to http://[IPofcamera]/current_config/Sha1Account1 then one should be able to view the content of the files. The security researchers assumed that this was only possible only after authentication to the device. However, when unauthenticated access tests were performed for the same URL as provided above, it was observed that the device file could be downloaded without any authentication.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-8228
📖 Read
via "National Vulnerability Database".
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification when allowing the user to add a new camera to the user's account to ensure that the user actually owns the camera other than knowing the serial number of the camera. This can allow an attacker who knows the serial number to easily add another user's camera to an attacker's cloud account and control it completely. This is possible in case of any camera that is currently not a part of an Amcrest cloud account or has been removed from the user's cloud account. Also, another requirement for a successful attack is that the user should have rebooted the camera in the last two hours. However, both of these conditions are very likely for new cameras that are sold over the Internet at many ecommerce websites or vendors that sell the Amcrest products. The successful attack results in an attacker being able to completely control the camera which includes being able to view and listen on what the camera can see, being able to change the motion detection settings and also be able to turn the camera off without the user being aware of it. Note: The same attack can be executed using the Amcrest Cloud mobile application.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-8227
📖 Read
via "National Vulnerability Database".
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are detected using the Web and HTTP API interface provided by the device. However, if the same brute force attempt is performed using the ONVIF specification (which is supported by the same binary) then there is no account lockout or timeout executed. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that performs the credential check in the binary for the ONVIF specification. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function at address 00671618 in IDA pro is parses the WSSE security token header. The sub_ 603D8 then performs the authentication check and if it is incorrect passes to the function sub_59F4C which prints the value "Sender not authorized."📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-8226
📖 Read
via "National Vulnerability Database".
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2017-13719
📖 Read
via "National Vulnerability Database".
The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various functionalities of the camera by using HTTP APIs, instead of the web management interface that is provided by the application. This HTTP API receives the credentials as base64 encoded in the Authorization HTTP header. However, a missing length check in the code allows an attacker to send a string of 1024 characters in the password field, and allows an attacker to exploit a memory corruption issue. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 is dissected using the binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that has many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that performs the credential check in the binary for the HTTP API specification. If we open this binary in IDA Pro we will notice that this follows an ARM little-endian format. The function at address 00415364 in IDA Pro starts the HTTP authentication process. This function calls another function at sub_ 0042CCA0 at address 0041549C. This function performs a strchr operation after base64 decoding the credentials, and stores the result on the stack, which results in a stack-based buffer overflow.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2015-3907
📖 Read
via "National Vulnerability Database".
CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.📖 Read
via "National Vulnerability Database".
🕴 D-Link Agrees to Strengthen Device Security 🕴
📖 Read
via "Dark Reading: ".
A settlement with the FTC should mean comprehensive security upgrades for D-Link routers and IP camera.📖 Read
via "Dark Reading: ".
Dark Reading
D-Link Agrees to Strengthen Device Security
A settlement with the FTC should mean comprehensive security upgrades for D-Link routers and IP camera.
⚠ TikTok investigated (again) over how it handles children’s data and safety ⚠
📖 Read
via "Naked Security".
It's already gotten hit with the biggest-ever US child privacy fine, and now it might be facing a fine for GDPR violations.📖 Read
via "Naked Security".
Naked Security
TikTok investigated (again) over how it handles children’s data and safety
It’s already gotten hit with the biggest-ever US child privacy fine, and now it might be facing a fine for GDPR violations.
⚠ Facebook should put a stop to Libra for now, says Congress ⚠
📖 Read
via "Naked Security".
Could Facebook's Libra cryptocurrency undermine the security of the global financial ecosystem?📖 Read
via "Naked Security".
Naked Security
Facebook should put a stop to Libra for now, says Congress
Could Facebook’s Libra cryptocurrency undermine the security of the global financial ecosystem?
⚠ Facebook’s down-ranking those ‘miracle cure’ health posts we all hate ⚠
📖 Read
via "Naked Security".
Clickbait health/nutrition posts will sink in page rankings due to two ranking updates, Facebook announced.📖 Read
via "Naked Security".
Naked Security
Facebook’s down-ranking those ‘miracle cure’ health posts we all hate
Clickbait health/nutrition posts will sink in page rankings due to two ranking updates, Facebook announced.