Website of gunmaker Smith & Wesson hit by a Magecart attack
The US gunmaker Smith & Wesson was hacked late last month in a Magecart attack, attackers injected a malicious software skimmer. A new Magecart attack made the headlines, the victim is the American gunmaker Smith & Wesson. The hack took place last month, the attackers planted a malicious software skimmer on…
Remote File Inclusion / Local File Inclusion
As with many exploits, remote and local file inclusions are only a problem at the end of theencoding. Of course it takes a second person to have it. Now this article will hopefully give youan idea of protecting your website and most importantly your code…
ABB Relion 670 Series
1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: Relion 670 Series Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to read and delete files on the device. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The…
Docker Patched the Most Severe Copy Vulnerability to Date With CVE-2019-14271
Executive Summary In the last few years, several vulnerabilities in the copy (cp) command were found in various container platforms, including Docker, Podman and Kubernetes. The most severe among those was only recently discovered and disclosed in July. Surprisingly, it gained almost no immediate attention,…
Injecting .NET Ransomware into Unmanaged Process
.Net is a modern, flexible, powerful and memory safe programming language with dozens of libraries and components, and exactly for this reason is the perfect choice to write any sort of malware threats, including ransomwares. The .Net Framework consists of two major components: The Common…
Flexera FlexNet Publisher
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Flexera Equipment: FlexNet Publisher Vulnerabilities: Improper Input Validation, Memory Corruption 2. RISK EVALUATION These vulnerabilities could allow an attacker to deny the acquisition of a valid license for legal use of the product. The memory…
Philips IntelliBridge EC40/80
1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Low skill level to exploit Vendor: Philips Equipment: IntelliBridge EC40 and EC80 Vulnerability: Inadequate Encryption Strength 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker unauthorized access to the IntelliBridge EC40/80 hub and may allow access to execute software,…
Siemens Mentor Nucleus Networking Module
1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: Mentor Nucleus Networking Module Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to affect the integrity and availability of the device. 3. TECHNICAL DETAILS 3.1 AFFECTED…
Siemens S7-1200 CPU
1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: S7-1200 CPU Vulnerability: Exposed Dangerous Method or Function 2. RISK EVALUATION Successful exploitation of this vulnerability could expose additional diagnostic functionality to an attacker with physical access to the UART interface…
Siemens Desigo PX Devices
1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Desigo PX Devices Vulnerability: External Control of Assumed-Immutable Web Parameter 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition on the device’s…
Stay connected