[FD] CVE-2017-12576: an hidden management page in PLANEX CS-QR20

Reserved CVE: CVE-2017-12576 # Description A hidden and undocumented management page allows an attacker to execute arbitrary code on the device when the user is authenticated. # Vulnerability Type Insecure Permissions # Affected Product Code Base Firmware ver 1.30 # Affected Component] Web

[FD] CVE-2017-11564: multiple command inject in D-Link EyeOn Baby Monitor (DCS-825L)

Reserved CVE: CVE-2017-11564 # Description The D-Link EyeOn Baby Monitor (DCS-825L) has multiple command injection vulnerabilities in the web service framework. An attacker can send a crafted request to execute commands; authentication is required before executing the attack. # Vulnerability

[FD] CVE-2017-12577: an hardcode credential in PLANEX CS-QR20

Reserved CVE: CVE-2017-12577 # Description A hardcoded account / password is used in the Android application that allows attackers to leverage hidden functions and execute arbitrary code on the device. # Vulnerability Type Insecure Permissions # Affected Product Code Base Firmware ver 1.30 #

[FD] RESPONSIVE filemanager

The following vulnerabilities were fixed in the version 9.13.4. https://responsivefilemanager.com #1 Path Traversal Allows to Read Any File Reserved CVE: CVE-2018-15535 Discovered By: Simon Uvarov Vendor Status: Fixed Details: The following request allows a user to read any file on the system.

[FD] CVE-2017-12574: Hardcode credential in PLANEX CS-W50HD

Reserved CVE: CVE-2017-12574 # Description A hidden and undocumented account exists that allows attackers to gain unauthorized access and control the device completely; the account can't be modified or deleted. # Vulnerability Type Default user/password # Affected Product Code Base Firmware

Re: [FD] Full Disclosure - Responsive File Manager

I contacted the developer warning of the vulnerability, but he did not respond. I released full disclosure, he had already released the update. I found manually checking yes Em Sáb, 11 de ago de 2018 13:52, Henri Salo escreveu: > On Wed, Aug 08, 2018 at 01:43:34PM -0300, Silton Renato wrote: >

[FD] DSA-2018-144: RSA Archer SQL Injection Vulnerability within embedded WorkPoint component

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 DSA-2018-144: RSA Archer SQL Injection Vulnerability within embedded WorkPoint component Dell EMC Identifier: DSA-2018-144 CVE Identifier: CVE-2018-11065 Severity Rating: CVSS:3 Base Score: 2.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

[FD] Defense in depth -- the Microsoft way (part 57): all the latest MSVCRT installers allow escalation of privilege

Hi @ll, about 6 weeks ago, Microsoft updated their MSKB article , listing the current/lastest downloads of their MSVCRT alias Microsoft Visual C++ Redistributable for Visual Studio 201x Guess what

[FD] CVE-2017-11563: Remote Code Execution via stack overflow in D-Link EyeOn Baby Monitor (DCS-825L)

Reserved CVE: CVE-2017-11563 # Description D-Link EyeOn Baby Monitor (DCS-825L) has a remote code execution vulnerability; a remote attacker can send a crafted request to finder and execute arbitrary code without authentication. # Vulnerability Type Buffer Overflow # Affected Product Code

[FD] CVE-2017-12573: command injection in PLANEX CS-W50HD

Reserved CVE: CVE-2017-12573 # Description The device has a command-injection vulnerability in the web management UI. An attacker can send a crafted HTTP POST request to execute arbitrary code. Authentication is required before executing the attack. # Vulnerability Type Command Injection #

[FD] DSA-2018-132: RSA NetWitness Platform Server-Side Template Injection Vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 DSA-2018-132: RSA NetWitness Platform Server-Side Template Injection Vulnerability Dell EMC Identifier: DSA-2018-132 CVE Identifier: CVE-2018-11061 Severity Rating: CVSS v3 Base Score: 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Severity:

[FD] XSS and CSRF vulnerabilities in ASUS RT-N15U

Hello list! There are multiple vulnerabilities in ASUS Wireless Router RT-N15U. There are Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities. - Affected products: - Vulnerable are the next models: ASUS RT-N15 and ASUS RT-N15U

[FD] Jetty 6.1.6 Cross-Site Scripting (XSS)

Title: Jetty 6.1.6 Cross-Site Scripting Date: 8/14/2018 Author: 1N3@CrowdShield - https://crowdshield.com Software Link: http://www.mortbay.org/jetty/ Tested on: Jetty 6.1.6 (other versions may also be vulnerable) CVE: N/A Background: Jetty 6.1.6 is vulnerable to Cross-Site Scripting (XSS) which

[FD] X41 D-Sec GmbH Security Advisory X41-2018-001: Multiple Vulnerabilities in Yubico Piv

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 X41 D-Sec GmbH Security Advisory: X41-2018-001 Multiple Vulnerabilities in Yubico Piv == Overview - Confirmed Affected Versions: 1.5.0 Confirmed Patched Versions: 1.6.0 Vendor: Yubico Vendor URL:

[FD] X41 D-Sec GmbH Security Advisory X41-2018-002: Multiple Vulnerabilities in OpenSC

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 X41 D-Sec GmbH Security Advisory: X41-2018-002 Multiple Vulnerabilities in OpenSC == Overview - Confirmed Affected Versions: 0.18.0 Confirmed Patched Versions: possibly 0.19.0 Vendor: OpenSC Vendor URL:

[FD] X41 D-Sec GmbH Security Advisory X41-2018-003: Multiple Vulnerabilities in pam_pkcs11

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 X41 D-Sec GmbH Security Advisory: X41-2018-003 Multiple Vulnerabilities in pam_pkcs11 == Overview - Confirmed Affected Versions: 0.6.9 Confirmed Patched Versions: - Vendor: Unmaintained Vendor URL:

[FD] X41 D-Sec GmbH Security Advisory X41-2018-004: Multiple Vulnerabilities in Yubico libykneomgr

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 X41 D-Sec GmbH Security Advisory: X41-2018-004 Multiple Vulnerabilities in Yubico libykneomgr == Overview - Confirmed Affected Versions: 0.1.9 Confirmed Patched Versions: - Vendor: Yubico /

[FD] X41 D-Sec GmbH Security Advisory X41-2018-005: Multiple Vulnerabilities in Apple smartcardservices

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 X41 D-Sec GmbH Security Advisory: X41-2018-005 Multiple Vulnerabilities in Apple smartcardservices === Overview - Confirmed Affected Versions: e3eb96a6eff9d02497a51b3c155a10fa5989021f

[FD] UISGCON14 CFP

Dear friends ! We are happy to announce that CFP for Ukrainian cybersecurity conference UISGCON14 is open! The conference will take place in Kyiv, Ukraine, 26th of October 2018. Venue will be Ukrainskiy Dim in a downtown. You have opportunity to submit for presentation,workshop,village or other

[FD] Multiple vulnerabilities in OSCAR EMR

Title: Multiple vulnerabilities in OSCAR EMR Product: OSCAR EMR Vendor: Oscar McMaster Tested version: 15.21beta361 Remediation status: Unknown Reported by: Brian D. Hysell - Product Description: "OSCAR is open-source Electronic Medical Record (EMR) software that was first developed at