po

Adobe Patches Important Bugs In Connect And Digital Edition





po

IBM Reports Huge Rise In Malicious Links




po

IBM Threat Report Highlights Data Risks








po

Positive Hack Days 10 Call For Papers

Call For Papers for Positive Hack Days 10 which will take place in Moscow, Russia May 13th through the 14th, 2020.





po

Dynamic Null-Free PopCalc Shellcode

223 bytes small dynamic, null-free popcalc shellcode.




po

Dynamic MessageBoxA||W PEB And Import Table Method Shellcode

232 bytes small Dynamic MessageBoxA||W PEB and Import Table Method shellcode.




po

Linux/x86 Reboot Polymorphic Shellcode

26 bytes small Linux/x86 reboot polymorphic shellcode.











po

Jinfornet Jreport 15.6 Directory Traversal

Jinfornet Jreport version 15.6 suffers from an unauthenticated directory traversal vulnerability.










po

Aleza Portal 1.6 Insecure Cookie

Aleza Portal version 1.6 suffers from an insecure cookie handling vulnerability that allows for SQL injection.






po

Cisco Patches Critical Vulnerabilities In Policy Suite




po

Nexus Switch Owners Told To Disable POAP Feature




po

Symantec Endpoint Protection Race Condition

Symantec Endpoint Protection versions 14.2.5323.2000, 14.2.5569.2100, and 14.2.5587.2100 suffer from a race condition vulnerability.




po

HC10 HC.Server Service 10.14 Remote Invalid Pointer Write

The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS if attackers can reach the service on port 8794. In addition this can potentially be leveraged for post exploit persistence with SYSTEM privileges, if physical access or malware is involved. If a physical attacker or malware can set its own program for the service failure recovery options, it can be used to maintain persistence. Afterwards, it can be triggered by sending a malicious request to DoS the service, which in turn can start the attackers recovery program. The attackers program can then try restarting the affected service to try an stay unnoticed by calling "sc start HCServerService". Services failure flag recovery options for "enabling actions for stops or errors" and can be set in the services "Recovery" properties tab or on the command line. Authentication is not required to reach the vulnerable service, this was tested successfully on Windows 7/10.




po

Plantronics Hub SpokesUpdateService Privilege Escalation

The Plantronics Hub client application for Windows makes use of an automatic update service SpokesUpdateService.exe which automatically executes a file specified in the MajorUpgrade.config configuration file as SYSTEM. The configuration file is writable by all users by default. This module has been tested successfully on Plantronics Hub version 3.13.2 on Windows 7 SP1 (x64). This Metasploit module has been tested successfully on Plantronics Hub version 3.13.2 on Windows 7 SP1 (x64).





po

Boeing Code Leak Exposes Security Flaws Deep In 787s




po

Planes, Gate, And Bags: How Hackers Can Hijack Your Local Airport




po

Lights That Warn Planes Of Obstacles Were Exposed To Open Internet





po

Online Job Portal 1.0 Cross Site Request Forgery

Online Job Portal version 1.0 suffers from a cross site request forgery vulnerability.




po

Maian Support Helpdesk 4.3 Cross Site Request Forgery

Maian Support Helpdesk version 4.3 suffers from a cross site request forgery vulnerability.