jetlib.sec

Feeds

232880 items (0 unread) in 27 feeds

• 0day.today (was: 1337day, Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Recent items

• May 21, 2018
• 8:31

  Wireless Headphone Hack Dangles Batteries Like Earrings

   » ‎ Hack a Day

  Koss Porta Pro headphones are something of a rarity in the world of audio gear: they’re widely regarded as sounding great, but don’t cost an exorbitant amount of money. Since the line was introduced in 1984, they’ve been the go-to headphones for those who don’t subscribe to the idea that you should have to take out a loan from the bank just to enjoy your music.

  [Jake Bickhard] is a confirmed Porta Pro disciple, owning enough pairs of them that he’s cagey about confirming how many are actually kicking around his home. The only thing he doesn’t like about them …read more

  Tags:  classic hacks  

• 7:01

  Explaining Efail and Why It Isn’t the End of Email Privacy

   » ‎ Hack a Day

  Last week the PGPocalipse was all over the news… Except that, well, it wasn’t an apocalypse.

  A team of researchers published a paper(PDF) where they describe how to decrypt a PGP encrypted email via a targeted attack. The research itself is pretty well documented and, from a security researcher perspective, it’s a good paper to read, especially the cryptography parts.

  But we here at Hackaday were skeptical about media claims that Efail had broken PGP. Some media reports went as far as recommending everyone turn off PGP encryption on all email clients., but they weren’t able to back this recommendation …read more

  Tags:  current Events  

• 6:30

  Qualys Security Advisory - Procps-ng Audit Report

   » ‎ Bugtraq

  Posted by Qualys Security Advisory on May 21

  Qualys Security Advisory
  
  Procps-ng Audit Report
  
  ========================================================================
  Contents
  ========================================================================
  
  Summary
  1. FUSE-backed /proc/PID/cmdline
  2. Unprivileged process hiding
  3. Local Privilege Escalation in top (Low Impact)
  4. Denial of Service in ps
  5. Local Privilege Escalation in libprocps (High Impact)
  5.1. Vulnerability
  5.2....
  

  Tags:   

• 4:00

  Ditch The Tapes, Put An Android In Your Deck

   » ‎ Hack a Day

  While we here at Hackaday never question why an individual took on a particular project, it surely doesn’t stop our beloved readers from grabbing their pitchforks and demanding such answers in the comments. Perhaps no posts generate more of this sort of furore than the ones which feature old audio gear infused with modern hardware. In almost every case the answer is the same: the person liked the look and feel of vintage hardware, but didn’t want to be limited to antiquated media.

  That sentiment is perhaps perfectly personified by the TapeLess Deck Project, created by [Artur Młynarz]. His creations …read more

  Tags:  android hacks  

• 3:35

  #0daytoday #Karenderia Multiple Restaurant System < 4.5 - Blind SQL Injection Vulnerabil [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Karenderia Multiple Restaurant System < 4.5 - Blind SQL Injection Vulnerabil [#0day #Exploit]

  Tags:   

• 3:11

  [SECURITY] [DSA 4205-1] Advance notification for upcoming end-of-life for

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on May 21

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-4205-1 security () debian org
  https://www.debian.org/security/ Moritz Muehlenhoff
  May 18, 2018 https://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  This is an advance notice that regular security support for Debian
  GNU/Linux...
  

  Tags:   

• 2:56

  #0daytoday #GitBucket 4.23.1 - Remote Code Execution Exploit [webapps #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #GitBucket 4.23.1 - Remote Code Execution Exploit [webapps #exploits #0day #Exploit]

  Tags:   

• 2:56

  #0daytoday #Zenar Content Management System - Cross-Site Scripting Vulnerability [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Zenar Content Management System - Cross-Site Scripting Vulnerability [#0day #Exploit]

  Tags:   

• 2:38

  [SECURITY] [DSA 4204-1] imagemagick security update

   » ‎ Bugtraq

  Posted by Sebastien Delafond on May 21

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-4204-1 security () debian org
  https://www.debian.org/security/ Sebastien Delafond
  May 18, 2018 https://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : imagemagick
  CVE ID : CVE-2017-10995 CVE-2017-11533...
  

  Tags:   

• 2:34

  [SYSS-2018-007] ILIAS e-Learning - Reflected Cross-Site-Scripting

   » ‎ Bugtraq

  Posted by Moritz Bechler on May 21

  Advisory ID: SYSS-2018-007
  Product: ILIAS
  Affected Version(s): 5.3.2, 5.2.14, 5.1.25
  Tested Version(s): 5.3.2, 5.2.12
  Vulnerability Type: Reflected Cross-Site-Scripting
  Risk Level: MEDIUM
  Solution Status: Fixed
  Manufacturer Notification: 2018-03-29
  Solution Date: 2018-04-25
  Public Disclosure: 2018-05-18
  CVE Reference: CVE-2018-10428
  Author of Advisory: Moritz Bechler, SySS GmbH...
  

  Tags:   

• 2:25

  #0daytoday #Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery Vulnerability [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery Vulnerability [#0day #Exploit]

  Tags:   

• 2:24

  #0daytoday #ManageEngine Recovery Manager Plus 5.3 - Persistent Cross-Site Scripting Vulnerability [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #ManageEngine Recovery Manager Plus 5.3 - Persistent Cross-Site Scripting Vulnerability [#0day #Exploit]

  Tags:   

• 2:22

  #0daytoday #Private Message PHP Script 2.0 - Persistent Cross-Site scripting Vulnerability [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Private Message PHP Script 2.0 - Persistent Cross-Site scripting Vulnerability [#0day #Exploit]

  Tags:   

• 2:21

  #0daytoday #Flippy DamnFacts - Viral Fun Facts Sharing Script 1.1.0 - XSS / CSRF Vulnerabilities [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Flippy DamnFacts - Viral Fun Facts Sharing Script 1.1.0 - XSS / CSRF Vulnerabilities [#0day #Exploit]

  Tags:   

• 2:19

  #0daytoday #Superfood 1.0 - Multiple Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Superfood 1.0 - Multiple Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]

  Tags:   

• 1:00

  RoMeLa’s Sideways Walking Robot Has Evolved More Limbs

   » ‎ Hack a Day

  Despite the success shown in prototypes from groups like Boston Dynamics, bipedal walking is still really hard to implement. When the robot lifts one leg, it has to shift its center of gravity over the other leg to avoid falling sideways.

  The Autonomous Legged Personal Helper Robot with Enhanced Dynamics (ALPHRED) is getting around this problem by coming at it from a different angle. ALPHRED walks sideways and throws away the distinction between arms and legs.

  The bot is RoMeLa at UCLA’s latest evolution in their approach to traditional bipedal roadblocks. Sideways walking is something we covered when we talked …read more

  Tags:  robots hacks  

• May 20, 2018
• 23:42

  Teen Phone Monitoring App Leaked Thousands Of Passwords

   » ‎ Packet Storm Security Headlines
  Teen Phone Monitoring App Leaked Thousands Of Passwords

  Tags:  headlineprivacyphonedata losspasswordspyware  

• 23:41

  Google Offers Free DDoS Protection Services For Democracy

   » ‎ Packet Storm Security Headlines
  Google Offers Free DDoS Protection Services For Democracy

  Tags:  headlinegovernmentdenial servicegoogle  

• 23:23

  Oracle Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  eventreg.oracle.com suffers from a cross site scripting vulnerability.

  Tags:   

• 23:23

  Oracle Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  eventreg.oracle.com suffers from a cross site scripting vulnerability.

  Tags:   

• 23:23

  Oracle Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  eventreg.oracle.com suffers from a cross site scripting vulnerability.

  Tags:   

• 22:01

  Slipcasting Resin Prototypes

   » ‎ Hack a Day

  [Eric Strebel] doesn’t need an introduction anymore. If there is a picture of an elegantly designed part with a professional finish on our pages, there is a good chance he has a hand in it. This time he is sharing his method of making a part which looks like it is blow-molded but it is not. Blow-molded parts have a distinctive look, especially made with a transparent material and [Eric’s] method certainly passes for it. This could upgrade your prototyping game if you need a few custom parts that look like solidified soap bubbles.

  Mold making is not covered in …read more

  Tags:  how-to  

• 19:00

  Card Reader Lockout Keeps Unauthorized Tool Users at Bay

   » ‎ Hack a Day

  It’s a problem common to every hackerspace, university machine shop, or even the home shops of parents with serious control issues: how do you make sure that only trained personnel are running the machines? There are all kinds of ways to tackle the problem, but why not throw a little tech at it with something like this magnetic card-reader machine lockout?

  [OnyxEpoch] does not reveal which of the above categories he falls into, if any, but we’ll go out on a limb and guess that it’s a hackerspace because it would work really well in such an environment. Built into …read more

  Tags:  Hackerspaces  

• 17:00

  [webapps] Superfood 1.0 - Multiple Vulnerabilities

   » ‎ Exploit-DB
  Superfood 1.0 - Multiple Vulnerabilities

  Tags:   

• 17:00

  [webapps] Zenar Content Management System - Cross-Site Scripting

   » ‎ Exploit-DB
  Zenar Content Management System - Cross-Site Scripting

  Tags:   

• 17:00

  [webapps] Flippy DamnFacts - Viral Fun Facts Sharing Script 1.1.0 - Persistent cross site scripting / Cross site request forgery

   » ‎ Exploit-DB
  Flippy DamnFacts - Viral Fun Facts Sharing Script 1.1.0 - Persistent cross site scripting / Cross site request forgery

  Tags:   

• 17:00

  [webapps] Private Message PHP Script 2.0 - Persistent Cross-Site scripting

   » ‎ Exploit-DB
  Private Message PHP Script 2.0 - Persistent Cross-Site scripting

  Tags:   

• 17:00

  [webapps] ManageEngine Recovery Manager Plus 5.3 (Build 5330) - Cross-Site-Scripting

   » ‎ Exploit-DB
  ManageEngine Recovery Manager Plus 5.3 (Build 5330) - Cross-Site Scripting

  Tags:   

• 17:00

  [webapps] Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery

   » ‎ Exploit-DB
  Siemens SIMATIC S7-1200 CPU - Cross-Site Request Forgery

  Tags:   

• 17:00

  [webapps] ManageEngine Recovery Manager Plus 5.3 - Persistent Cross-Site Scripting

   » ‎ Exploit-DB
  ManageEngine Recovery Manager Plus 5.3 - Persistent Cross-Site Scripting

  Tags:   

• 17:00

  [webapps] GitBucket 4.23.1 - Remote Code Execution

   » ‎ Exploit-DB
  GitBucket 4.23.1 - Remote Code Execution

  Tags:   

• 17:00

  [webapps] Karenderia Multiple Restaurant System < 4.5 - Blind SQL Injection

   » ‎ Exploit-DB
  Karenderia Multiple Restaurant System

  Tags:   

• 17:00

  [local] Linux 2.6.30 - 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit)

   » ‎ Exploit-DB
  Linux 2.6.30 - 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit)

  Tags:   

• 17:00

  [webapps] Teradek Slice 7.3.15 - Cross-Site Request Forgery

   » ‎ Exploit-DB
  Teradek Slice 7.3.15 - Cross-Site Request Forgery

  Tags:   

• 17:00

  [webapps] Teradek Cube 7.3.6 - Cross-Site Request Forgery

   » ‎ Exploit-DB
  Teradek Cube 7.3.6 - Cross-Site Request Forgery

  Tags:   

• 17:00

  [webapps] Teradek VidiU Pro 3.0.3 - Server-Side Request Forgery

   » ‎ Exploit-DB
  Teradek VidiU Pro 3.0.3 - Server-Side Request Forgery

  Tags:   

• 17:00

  [webapps] Teradek VidiU Pro 3.0.3 - Cross-Site Request Forgery

   » ‎ Exploit-DB
  Teradek VidiU Pro 3.0.3 - Cross-Site Request Forgery

  Tags:   

• 17:00

  [papers] Code review steps and methodologies

   » ‎ Exploit-DB
  Code review steps and methodologies

  Tags:   

• 17:00

  [webapps] Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin panel Authentication bypass

   » ‎ Exploit-DB
  Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin panel Authentication bypass

  Tags:   

• 17:00

  [webapps] Schneider Electric PLCs - Cross-Site Request Forgery

   » ‎ Exploit-DB
  Schneider Electric PLCs - Cross-Site Request Forgery

  Tags:   

• 17:00

  [webapps] Model Agency Media House & Model Gallery 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Authentication bypass

   » ‎ Exploit-DB
  Model Agency Media House & Model Gallery 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Authentication bypass

  Tags:   

• 17:00

  [webapps] Merge PACS 7.0 - Cross-Site Request Forgery

   » ‎ Exploit-DB
  Merge PACS 7.0 - Cross-Site Request Forgery

  Tags:   

• 17:00

  [local] R v3.4.4 - Local Buffer Overflow (DEP Bypass)

   » ‎ Exploit-DB
  R v3.4.4 - Local Buffer Overflow (DEP Bypass)

  Tags:   

• 17:00

  [webapps] Wchat PHP AJAX Chat Script 1.5 - Persistent Cross-Site Scripting

   » ‎ Exploit-DB
  Wchat PHP AJAX Chat Script 1.5 - Persistent Cross-Site Scripting

  Tags:   

• 16:00

  Hackaday Links: May 20, 2018

   » ‎ Hack a Day

  One of the more interesting pieces of tech from Hollywood that never seems to become a reality is a location tracker. Remember the ‘movement tracker’ in Alien that found the cat in the locker? Yeah, like that. Something that reports the direction and distance to a target, kind of like a PKE Meter from Ghostbusters. I think there was something like this in Predator. On Indiegogo, there’s a device that tracks other devices. It’s called the Lynq, and it’s a small, handheld device that tells you the distance and bearing of other paired devices. Hand them out to your …read more

  Tags:  hackaday Columns  

• 13:01

  Inverted Pendulum For The Control Enthusiast

   » ‎ Hack a Day

  Once you step into the world of controls, you quickly realize that controlling even simple systems isn’t as easy as applying voltage to a servo. Before you start working on your own bipedal robot or scratch-built drone, though, you might want to get some practice with this intricate field of engineering. A classic problem in this area is the inverted pendulum, and [Philip] has created a great model of this which helps illustrate the basics of controls, with some AI mixed in.

  Called the ZIPY, the project is a “Cart Pole” design that uses a movable cart on a trolley …read more

  Tags:  the hackaday prize  

• 10:01

  Stretching The Definitions Of A Custom IC

   » ‎ Hack a Day

  Maker Faire is the nexus for all things new and exciting. At the Bay Area Maker Faire this weekend, zGlue introduced a new platform that stretches the definition of custom ICs. Is this custom silicon? No, not at all. zGlue is a platform allowing anyone to take off-the-shelf ICs and package them into a single module, allowing you to build a smaller PCB with a shorter BOM.

  The idea behind zGlue is to take all of the fun chips available today from accelerometers to tiny microcontrollers with integrated wireless and put them on a tiny, tiny board that is then …read more

  Tags:  Hardware  

• 9:23

  Blunder Burns Unicorn Attack That Exploited Windows And Reader

   » ‎ Packet Storm Security Headlines
  Blunder Burns Unicorn Attack That Exploited Windows And Reader

  Tags:  headlinehackermalwaremicrosoftflawadobe  

• 9:16

  #0daytoday #Adobe Enterprise Manager (AEM) 6.3 - Remote Code Execution Exploit [webapps #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Adobe Enterprise Manager (AEM) 6.3 - Remote Code Execution Exploit [webapps #exploits #0day #Exploit]

  Tags:   

• 9:16

  #0daytoday #Joomla EkRishta 2.10 Component - Cross-Site Scripting / SQL Injection Vulnerabilities [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Joomla EkRishta 2.10 Component - Cross-Site Scripting / SQL Injection Vulnerabilities [#0day #Exploit]

  Tags:   

• 9:16

  #0daytoday #Adobe Enterprise Manager (AEM) 6.3 - Remote Code Execution Exploit [webapps #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Adobe Enterprise Manager (AEM) 6.3 - Remote Code Execution Exploit [webapps #exploits #0day #Exploit]

  Tags:   

• 9:16

  #0daytoday #Joomla #EkRishta 2.10 Component - Cross-Site Scripting / SQL Injection Vulnerabilities [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Joomla #EkRishta 2.10 Component - Cross-Site Scripting / SQL Injection Vulnerabilities [#0day #Exploit]

  Tags:   

• 9:16

  Adobe Experience Manager (AEM) Remote Code Execution

   » ‎ Packet Storm Security Exploits
  Default credentials in Adobe Experience Manager (AEM) versions prior to 6.3 can lead to remote code execution.

  Tags:   

• 9:16

  Adobe Experience Manager (AEM) Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  Default credentials in Adobe Experience Manager (AEM) versions prior to 6.3 can lead to remote code execution.

  Tags:   

• 9:16

  Adobe Experience Manager (AEM) Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  Default credentials in Adobe Experience Manager (AEM) versions prior to 6.3 can lead to remote code execution.

  Tags:   

• 9:15

  D-Link DSL-3782 Authentication Bypass

   » ‎ Packet Storm Security Exploits
  D-Link DSL-3782 suffers from an authentication bypass vulnerability.

  Tags:   

• 9:15

  D-Link DSL-3782 Authentication Bypass

   » ‎ Packet Storm Security Recent Files
  D-Link DSL-3782 suffers from an authentication bypass vulnerability.

  Tags:   

• 9:15

  D-Link DSL-3782 Authentication Bypass

   » ‎ Packet Storm Security Misc. Files
  D-Link DSL-3782 suffers from an authentication bypass vulnerability.

  Tags:   

• 9:13

  Easy MPEG To DVD Burner 1.7.11 Buffer Overflow

   » ‎ Packet Storm Security Exploits
  Easy MPEG to DVD Burner version 1.7.11 local buffer overflow SEH exploit with DEP bypass.

  Tags:   

• 9:13

  Easy MPEG To DVD Burner 1.7.11 Buffer Overflow

   » ‎ Packet Storm Security Recent Files
  Easy MPEG to DVD Burner version 1.7.11 local buffer overflow SEH exploit with DEP bypass.

  Tags:   

• 9:13

  Easy MPEG To DVD Burner 1.7.11 Buffer Overflow

   » ‎ Packet Storm Security Misc. Files
  Easy MPEG to DVD Burner version 1.7.11 local buffer overflow SEH exploit with DEP bypass.

  Tags:   

• 9:11

  Joomla EkRishta 2.10 Cross Site Scripting / SQL Injection

   » ‎ Packet Storm Security Exploits
  Joomla EkRishta component version 2.10 suffers from cross site scripting and remote SQL injection vulnerabilities.

  Tags:   

• 9:11

  Joomla EkRishta 2.10 Cross Site Scripting / SQL Injection

   » ‎ Packet Storm Security Recent Files
  Joomla EkRishta component version 2.10 suffers from cross site scripting and remote SQL injection vulnerabilities.

  Tags:   

• 9:11

  Joomla EkRishta 2.10 Cross Site Scripting / SQL Injection

   » ‎ Packet Storm Security Misc. Files
  Joomla EkRishta component version 2.10 suffers from cross site scripting and remote SQL injection vulnerabilities.

  Tags:   

• 9:10

  mySCADA myPRO 7 Hardcoded Credentials

   » ‎ Packet Storm Security Exploits
  mySCADA myPRO version 7 has a hardcoded FTP username and password.

  Tags:   

• 9:10

  mySCADA myPRO 7 Hardcoded Credentials

   » ‎ Packet Storm Security Recent Files
  mySCADA myPRO version 7 has a hardcoded FTP username and password.

  Tags:   

• 9:10

  mySCADA myPRO 7 Hardcoded Credentials

   » ‎ Packet Storm Security Misc. Files
  mySCADA myPRO version 7 has a hardcoded FTP username and password.

  Tags:   

• 9:08

  Gentoo Linux Security Advisory 201805-06

   » ‎ Packet Storm Security Advisories
  Gentoo Linux Security Advisory 201805-6 - Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in privilege escalation. Versions less than 66.0.3359.170 are affected.

  Tags:   

• 9:08

  Gentoo Linux Security Advisory 201805-06

   » ‎ Packet Storm Security Recent Files
  Gentoo Linux Security Advisory 201805-6 - Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in privilege escalation. Versions less than 66.0.3359.170 are affected.

  Tags:   

• 9:08

  Gentoo Linux Security Advisory 201805-06

   » ‎ Packet Storm Security Misc. Files
  Gentoo Linux Security Advisory 201805-6 - Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in privilege escalation. Versions less than 66.0.3359.170 are affected.

  Tags:   

• 8:50

  #0daytoday #DLink #DSL3782 - Authentication Bypass Vulnerability CVE-2018-8898 [webapps #exploits #Vulnerability #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #DLink #DSL3782 - Authentication Bypass Vulnerability CVE-2018-8898 [webapps #exploits #Vulnerability #0day #Exploit]

  Tags:   

• 8:50

  #0daytoday #Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass) Exploit [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass) Exploit [#0day #Exploit]

  Tags:   

• 8:50

  #0daytoday #mySCADA myPRO 7 - Hard-Coded Credentials Vulnerability CVE-2018-11311 [remote #exploits #Vulnerability #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #mySCADA myPRO 7 - Hard-Coded Credentials Vulnerability CVE-2018-11311 [remote #exploits #Vulnerability #0day #Exploit]

  Tags:   

• 8:50

  #0daytoday #D-Link DSL-3782 - Authentication Bypass Vulnerability CVE-2018-8898 [webapps #exploits #Vulnerability #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #D-Link DSL-3782 - Authentication Bypass Vulnerability CVE-2018-8898 [webapps #exploits #Vulnerability #0day #Exploit]

  Tags:   

• 7:00

  Internet of Laundry — Let the ESP8266 Watch Your Dirty Drawers Get Clean

   » ‎ Hack a Day

  When you think of world-changing devices, you usually don’t think of the washing machine. However, making laundry manageable changed not only how we dress but how much time people spent getting their clothes clean. So complaining about how laborious our laundry is today would make someone from the 1800s laugh. Still, we all hate the laundry and [Andrew Dupont], in particular, hates having to check on the machine to see if it is done. So he made Laundry Spy.

  How do you sense when the machine — either a washer or a dryer — is done? [Andrew] thought about sensing …read more

  Tags:  arduino hacks  

• 4:01

  Tiny Sideways Tetris on a Business Card

   » ‎ Hack a Day

  Everyone recognizes Tetris, even when it’s tiny Tetris played sideways on a business card. [Michael Teeuw] designed these PCBs and they sport small OLED screens to display contact info. The Tetris game is actually a hidden easter egg; a long press on one of the buttons starts it up.

  It turns out that getting a playable Tetris onto the ATtiny85 microcontroller was a challenge. Drawing lines and shapes is easy with resources like TinyOLED or Adafruit’s SSD1306 library, but to draw those realtime graphics onto the 128×32 OLED using that method requires a buffer size that wouldn’t fit the ATtiny85’s …read more

  Tags:  attiny hacks  

• 1:01

  Video of the Arduino FPGA Board Demo at Maker Faire

   » ‎ Hack a Day

  This week, Arduino announced a lot of new hardware including an exceptionally interesting FPGA development board aimed at anyone wanting to dip their toes into the seas of VHDL and developing with programmable logic. We think it’s the most interesting bit of hardware Arduino has released since their original dev board, and everyone is wondering what the hardware actually is, and what it can do.

  This weekend at Maker Faire Bay Area, Arduino was out giving demos for all their wares, and yes, the Arduino MKR Vidor 4000 was on hand, being shown off in a working demo. We have …read more

  Tags:  arduino hacks  

• May 19, 2018
• 22:01

  Scrapped Motors Don’t Care About Direction

   » ‎ Hack a Day

  Spinners built into games of chance like roulette or tabletop board games stop on a random number after being given a good spin. There is no trick, but they eventually rest because of friction, no matter how hard your siblings wind up for a game-winning turn. What if the spinning continued forever and there was no programming because there was no controller? [Ludic Science] shows us his method of making a perpetual spinner with nothing fancier than a scrapped hard disk drive motor and a transformer. His video can also be seen below the break.

  Fair warning: this involves mains …read more

  Tags:  Hardware  

• 19:01

  Friend in Need Gets Junk Bin PC for Cramped Quarters

   » ‎ Hack a Day

  If you doubt the power of the Hackaday community, check this one out. Stalwart reader and tipster [starhawk] has pitched in to help a friend in need, someone he met through Hackaday.io. Seems this friend’s current living arrangements are somewhat on the cramped side, and while he’s in need of a PC, even a laptop would claim too much space.

  So with a quick trip to the store and a few items from the junk bin, [starhawk] whipped up an all-in-one PC the size of a tablet for his friend. As impressed as we are by the generosity, we’re more …read more

  Tags:  computer hacks  

• 17:00

  [remote] mySCADA myPRO 7 - Hard-Coded Credentials

   » ‎ Exploit-DB
  mySCADA myPRO 7 - Hard-Coded Credentials

  Tags:   

• 17:00

  [webapps] D-Link DSL-3782 - Authentication Bypass

   » ‎ Exploit-DB
  D-Link DSL-3782 - Authentication Bypass

  Tags:   

• 17:00

  [local] Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass)

   » ‎ Exploit-DB
  Easy MPEG to DVD Burner 1.7.11 - Local Buffer Overflow (SEH) (DEP Bypass)

  Tags:   

• 17:00

  [webapps] Joomla! Component EkRishta 2.10 - Cross-Site Scripting / SQL Injection

   » ‎ Exploit-DB
  Joomla! Component EkRishta 2.10 - Cross-Site Scripting / SQL Injection

  Tags:   

• 17:00

  [webapps] Adobe Enterprise Manager (AEM) < 6.3 - Remote Code Execution

   » ‎ Exploit-DB
  Adobe Enterprise Manager (AEM)

  Tags:   

• 16:01

  It’s Not Morning Until Green o’clock

   » ‎ Hack a Day

  [JohnathonT] has a two-year-old who can’t reliably tell time just yet. Every morning, he gets up before the rooster crows and barges into his parents’ room, ready to face the day.

  In an effort to catch a few more Zs, [JohnathonT] built a simple but sanity-saving clock that tells time in a visual, kid-friendly way. Sure, this is a simple build. But if a toddler is part of your reality, who has time to make one from logic gates? The hardware is what you’d expect to see: Arduino Nano, a DS1307 RTC, plus the LEDs and resistors. We think an …read more

  Tags:  arduino hacks  

• 13:09

  Visit Tapigami Tape City, Where Tape Is The Fabric Of Society

   » ‎ Hack a Day

  With so many cool things going on at Bay Area Maker Faire, it takes something special to stand out from the crowd. Covering several hundred square feet of floor and wall with creations made of tape would do the trick. Welcome to Tapigami Tape City, a traveling art exhibit by [Danny Scheible].

  Many of us used construction paper, glue, and tape to express our creativity in our youth. Tapigami’s minimalism drops the paper and glue, practitioners of the art stick to tape. It is an accessible everyday material so there is no barrier to entry to start having fun. And …read more

  Tags:  misc hacks  

• 10:01

  People with Dementia can DRESS Smarter

   » ‎ Hack a Day

  People with dementia have trouble with some of the things we take for granted, including dressing themselves. It can be a remarkably difficult task involving skills like balance, pattern recognition inside of other patterns, ordering, gross motor skill, and dexterity to name a few. Just because something is common, doesn’t mean it is easy. The good folks at NYU Rory Meyers College of Nursing, Arizona State University, and MGH Institute of Health Professions talked with a caregiver focus group to find a way for patients to regain their privacy and replace frustration with independence.

  Although this is in the context …read more

  Tags:  digital cameras hacks  

• 9:05

  #0daytoday #Reliable Datagram Sockets (RDS) Privilege Escalation Exploit [remote #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Reliable Datagram Sockets (RDS) Privilege Escalation Exploit [remote #exploits #0day #Exploit]

  Tags:   

• 7:33

  #0daytoday #Cisco SA520W Security Appliance - Path Traversal Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Cisco SA520W Security Appliance - Path Traversal Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]

  Tags:   

• 7:31

  #0daytoday #SAP B2B / B2C CRM 2.x &lt; 4.x - Local File Inclusion Vulnerability [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #SAP B2B / B2C CRM 2.x &lt; 4.x - Local File Inclusion Vulnerability [#0day #Exploit]

  Tags:   

• 7:31

  #0daytoday #Monstra CMS before 3.0.4 - Cross-Site Scripting Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Monstra CMS before 3.0.4 - Cross-Site Scripting Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]

  Tags:   

• 7:31

  #0daytoday #SAP NetWeaver Web Dynpro 6.4 &lt; 7.5 - Information Disclosure Vulnerability [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #SAP NetWeaver Web Dynpro 6.4 &lt; 7.5 - Information Disclosure Vulnerability [#0day #Exploit]

  Tags:   

• 7:31

  #0daytoday #Cisco SA520W Security Appliance - Path Traversal Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Cisco SA520W Security Appliance - Path Traversal Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]

  Tags:   

• 7:27

  #0daytoday #Healwire Online Pharmacy 3.0 - XSS / CSRF Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Healwire Online Pharmacy 3.0 - XSS / CSRF Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]

  Tags:   

• 7:27

  #0daytoday #Powerlogic / Schneider Electric IONXXXX Series - Cross-Site Request Forgery Vulnerabili [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Powerlogic / Schneider Electric IONXXXX Series - Cross-Site Request Forgery Vulnerabili [#0day #Exploit]

  Tags:   

• 7:27

  #0daytoday #Infinity Market Classified Ads Script 1.6.2 - Cross-Site Request Forgery Vulnerability [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Infinity Market Classified Ads Script 1.6.2 - Cross-Site Request Forgery Vulnerability [#0day #Exploit]

  Tags:   

• 7:05

  #0daytoday #SuperCom Online Shopping Ecommerce Cart 1 - XSS / CSRF / Authentication bypass Vulnerab [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #SuperCom Online Shopping Ecommerce Cart 1 - XSS / CSRF / Authentication bypass Vulnerab [#0day #Exploit]

  Tags:   

• 7:00

  Motorized Stage Finesses the Microscopic World

   » ‎ Hack a Day

  No matter how fine your fine motor skills may be, it’s really hard to manipulate anything on the stage of a microscope with any kind of accuracy. One jitter or caffeine-induced tremor means the feature of interest on the sample you’re looking at shoots off out of the field of view, and getting back to where you were is a tedious matter of trial and error.

  Mechanical help on the microscope stage is nice, and electromechanical help is even better, but a DIY fully motorized microscope stage with complete motion control is the way to go for the serious microscopist …read more

  Tags:  misc hacks  

• 4:00

  One-key Keyboard is Exercise in Sub-millimeter Design

   » ‎ Hack a Day

  As [Glen] describes it, the only real goal in his decision to design his single-key USB keyboard was to see how small he could build a functional keyboard using a Cherry MX key switch, and every fraction of a millimeter counted. Making a one-key USB keyboard is one thing, but making it from scratch complete with form-fitting enclosure that’s easy to assemble required careful design, and luckily for all of us, [Glen] has documented it wonderfully. (Incidentally, Cherry MX switches come in a variety of qualities and features, the different models being identified by their color. [Glen] is using a …read more

  Tags:  how-to  

• 1:00

  Parallel Programming for FPGAs

   » ‎ Hack a Day

  One of the best features of using FPGAs for a design is the inherent parallelism. Sure, you can write software to take advantage of multiple CPUs. But with an FPGA you can enjoy massive parallelism since all the pieces are just hardware. Every light switch in your house operates in parallel with the others. There’s a new edition of a book, titled Parallel Programming for FPGAs that explores that topic in depth and it is under the Creative Commons license. In particular, the book focuses on using Vivado HLS instead of the more traditional Verilog or VHDL.

  HLS allows a …read more

  Tags:  fpga  

• May 18, 2018
• 23:48

  Reliable Datagram Sockets (RDS) Privilege Escalation

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits a vulnerability in the rds_page_copy_user function in net/rds/page.c (RDS) in Linux kernel versions 2.6.30 to 2.6.36-rc8 to execute code as root (CVE-2010-3904). This Metasploit module has been tested successfully on Fedora 13 (i686) with kernel version 2.6.33.3-85.fc13.i686.PAE and Ubuntu 10.04 (x86_64) with kernel version 2.6.32-21-generic.

  Tags:   

• 23:48

  Reliable Datagram Sockets (RDS) Privilege Escalation

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits a vulnerability in the rds_page_copy_user function in net/rds/page.c (RDS) in Linux kernel versions 2.6.30 to 2.6.36-rc8 to execute code as root (CVE-2010-3904). This Metasploit module has been tested successfully on Fedora 13 (i686) with kernel version 2.6.33.3-85.fc13.i686.PAE and Ubuntu 10.04 (x86_64) with kernel version 2.6.32-21-generic.

  Tags:   

• 23:48

  Reliable Datagram Sockets (RDS) Privilege Escalation

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits a vulnerability in the rds_page_copy_user function in net/rds/page.c (RDS) in Linux kernel versions 2.6.30 to 2.6.36-rc8 to execute code as root (CVE-2010-3904). This Metasploit module has been tested successfully on Fedora 13 (i686) with kernel version 2.6.33.3-85.fc13.i686.PAE and Ubuntu 10.04 (x86_64) with kernel version 2.6.32-21-generic.

  Tags:   

• 23:45

  Red Hat Security Advisory 2018-1627-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2018-1627-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 23:45

  Red Hat Security Advisory 2018-1627-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2018-1627-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 23:45

  Red Hat Security Advisory 2018-1627-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2018-1627-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 23:43

  Ubuntu Security Notice USN-3645-2

   » ‎ Packet Storm Security Advisories
  Ubuntu Security Notice 3645-2 - USN-3645-1 fixed vulnerabilities in Firefox. The update caused an issue where users experienced long UI pauses in some circumstances. This update fixes the problem. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cross-site scripting attacks, install lightweight themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code. Various other issues were also addressed.

  Tags:   

• 23:43

  Ubuntu Security Notice USN-3645-2

   » ‎ Packet Storm Security Recent Files
  Ubuntu Security Notice 3645-2 - USN-3645-1 fixed vulnerabilities in Firefox. The update caused an issue where users experienced long UI pauses in some circumstances. This update fixes the problem. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cross-site scripting attacks, install lightweight themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code. Various other issues were also addressed.

  Tags:   

• 23:43

  Ubuntu Security Notice USN-3645-2

   » ‎ Packet Storm Security Misc. Files
  Ubuntu Security Notice 3645-2 - USN-3645-1 fixed vulnerabilities in Firefox. The update caused an issue where users experienced long UI pauses in some circumstances. This update fixes the problem. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cross-site scripting attacks, install lightweight themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code. Various other issues were also addressed.

  Tags:   

• 23:38

  Fake Fortnite Malware Apps Are Spreading

   » ‎ Packet Storm Security Headlines
  Fake Fortnite Malware Apps Are Spreading

  Tags:  headlinemalware  

• 23:38

  Cambridge Analytica Starts Bankruptcy Proceedings In US

   » ‎ Packet Storm Security Headlines
  Cambridge Analytica Starts Bankruptcy Proceedings In US

  Tags:  headlinegovernmentprivacyusabritainfraudfacebook  

• 23:38

  Mirai Botnet Adds Three New Attacks To Target IoT Devices

   » ‎ Packet Storm Security Headlines
  Mirai Botnet Adds Three New Attacks To Target IoT Devices

  Tags:  headlinemalwarebotnet  

• 23:38

  A Congressional Debate Was Hacked To Show Gay Porn

   » ‎ Packet Storm Security Headlines
  A Congressional Debate Was Hacked To Show Gay Porn

  Tags:  headlinehackergovernmentusa  

• 22:00

  Nuclear Synchroscope Gets New Life

   » ‎ Hack a Day

  The Synchroscope is an interesting power plant instrument which doubles up as two devices in one. If the generator frequency is not matched with the grid frequency, the rotation direction of the synchroscope pointer indicates if the frequency (generator speed) needs to be increased or decreased. When it stops rotating, the pointer angle indicates the phase difference between the generator and the grid. When [badjer1] [Chris Muncy] got his hands on an old synchroscope which had seen better days at a nuclear power plant control room, he decided to use it as the enclosure for a long-pending plan to build …read more

  Tags:  Hardware  

• 19:00

  Hybrid Bench Power Supply Can Also Hit the Road

   » ‎ Hack a Day

  Everyone needs a bench power supply, and rolling your own has almost become a rite of passage for hackers. For a long time, the platform of choice for such builds seemed to be the ATX power supply from a computer. While we certainly still see those builds, a lot of the action has switched to those cheap eBay programmable DC-DC converters, with their particolored digital displays.

  This hybrid bench and portable power supply is a good example of what can be accomplished with these modules, and looks like it might turn out to be a handy tool. [Luke] centered his …read more

  Tags:  tool hacks  

• 16:01

  Modular Blocks Help Fight Disease

   » ‎ Hack a Day

  When engineering a solution to a problem, an often-successful approach is to keep the design as simple as possible. Simple things are easier to produce, maintain, and use. Whether you’re building a robot, operating system, or automobile, this type of design can help in many different ways. Now, researchers at MIT’s Little Devices Lab have taken this philosophy to testing for various medical conditions, using a set of modular blocks.

  Each block is designed for a specific purpose, and can be linked together with other blocks. For example, one block may be able to identify Zika virus, and another block …read more

  Tags:  chemistry hacks  

• 15:22

  Microsoft Security Bulletin CVE Revision Increment For May, 2018

   » ‎ Packet Storm Security Advisories
  This Microsoft bulletin summary holds CVE revision updates for CVE-2018-0886.

  Tags:   

• 15:22

  Microsoft Security Bulletin CVE Revision Increment For May, 2018

   » ‎ Packet Storm Security Recent Files
  This Microsoft bulletin summary holds CVE revision updates for CVE-2018-0886.

  Tags:   

• 15:22

  Microsoft Security Bulletin CVE Revision Increment For May, 2018

   » ‎ Packet Storm Security Misc. Files
  This Microsoft bulletin summary holds CVE revision updates for CVE-2018-0886.

  Tags:   

• 15:03

  CloudFrunt – Identify Misconfigured CloudFront Domains

   » ‎ Darknet
  

  CloudFrunt is a Python-based tool for identifying misconfigured CloudFront domains, it uses DNS and looks for CNAMEs which may be allowed to be associated with CloudFront distributions. This effectively allows for domain hijacking.

  How CloudFrunt Works For Misconfigured CloudFront

  CloudFront is a Content Delivery Network (CDN) provided by Amazon Web Services (AWS). CloudFront users create “distributions” that serve content from specific sources (an S3 bucket, for example).

  Each CloudFront distribution has a unique endpoint for users to point their DNS records to (ex.

  Read the rest of CloudFrunt – Identify Misconfigured CloudFront Domains now! Only available at Darknet.

  Tags:  hacking Tools  

• 13:01

  Tiny Transmitter Brings Out the Spy Inside You

   » ‎ Hack a Day

  When it comes to surveillance, why let the government have all the fun? This tiny spy transmitter is just the thing you need to jumpstart your recreational espionage efforts.

  We kid, of course — you’ll want to stay within the law of the land if you choose to build [TomTechTod]’s diminutive transmitter. Barely bigger than the 337 button cell that powers it, the scrap of PCB packs a fair number of surface mount components, most in 0201 packages. Even so, the transmitter is a simple design, with a two transistor audio stage amplifying the signal from the MEMS microphone and …read more

  Tags:  radio hacks  

• 11:30

  Autonomous Agribots For Agriculture

   » ‎ Hack a Day

  For his Hackaday Prize entry, [TegwynTwmffat] is going all-in on autonomous robotics. No, it’s not a self-driving car with highly advanced features such as cruise control with lane-keeping. This is an autonomous robot that’s capable of driving itself. It’s a robot built for agriculture, and relative to other autonomous robotics projects, this one is huge. It’s the size of a small tractor.

  The goal [Tegwyn]’s project is to build a robot capable of roving fields of crops to weed, harvest, and possibly fertilize the land. This is a superset of the autonomous car problem: not only does [Tegwyn] need …read more

  Tags:  the hackaday prize  

• 10:02

  Healwire Online Pharmacy 3.0 Cross Site Request Forgery / Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  Healwire Online Pharmacy version 3.0 suffers from cross site request forgery and cross site scripting vulnerabilities.

  Tags:   

• 10:02

  Healwire Online Pharmacy 3.0 Cross Site Request Forgery / Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  Healwire Online Pharmacy version 3.0 suffers from cross site request forgery and cross site scripting vulnerabilities.

  Tags:   

• 10:02

  Healwire Online Pharmacy 3.0 Cross Site Request Forgery / Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  Healwire Online Pharmacy version 3.0 suffers from cross site request forgery and cross site scripting vulnerabilities.

  Tags:   

• 10:00

  InSight Brings New Tech to Mars

   » ‎ Hack a Day

  Unless you’ve got your ear on the launch pad so to speak, you might not be aware that humanity just launched a new envoy towards the Red Planet. Estimated to touch down in Elysium Planitia on November 26th, the InSight lander is relatively low-key as far as interplanetary missions go. Part of the NASA’s “Discovery Program”, it operates on a considerably lower budget than Flagship missions such as the Curiosity rover; meaning niceties like a big advertising and social media campaign to get the public excited doesn’t get a line item.

  Which is a shame, because not only are there …read more

  Tags:  current Events  

• 9:41

  #0daytoday #Prime95 29.4b8 - Stack Buffer Overflow (SEH) Exploit [remote #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Prime95 29.4b8 - Stack Buffer Overflow (SEH) Exploit [remote #exploits #0day #Exploit]

  Tags:   

• 9:22

  #0daytoday #Linux 4.8.0 &lt; 4.8.0-46 - AF_PACKET packet_set_ring Privilege Escalation Expl [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Linux 4.8.0 &lt; 4.8.0-46 - AF_PACKET packet_set_ring Privilege Escalation Expl [#0day #Exploit]

  Tags:   

• 9:20

  #0daytoday #Linux &lt; 4.16.9 / &lt; 4.14.41 - 4-byte Infoleak via Uninitialized St [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Linux &lt; 4.16.9 / &lt; 4.14.41 - 4-byte Infoleak via Uninitialized St [#0day #Exploit]

  Tags:   

• 9:01

  LayerOne InfoSec Conference Returns Next Weekend

   » ‎ Hack a Day

  This year’s LayerOne conference is May 25-27 in Los Angeles and Hackaday will be there! Hurry and get your ticket now as today is the last day for pre-registration.

  As the InfoSec community takes over the Pasadena Hilton next weekend you’ll wish you had a week instead of just three days to take part in all that is offered. There are organized talks and workshops on pen testing, being the bad guy, and DevOps Security. Learn or improve on your lockpicking skills in the Lockpicking Village. The conference hardware badge will be hacking in every direction in the Hardware Village, …read more

  Tags:  cons  

• 8:06

  #0daytoday #Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution Exploit [#0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Apache Struts 2 - Struts 1 Plugin Showcase OGNL Code Execution Exploit [#0day #Exploit]

  Tags:   

• 8:06

  #0daytoday #Microsoft Edge Chakra JIT - Bound Check Elimination Bug Exploit [dos #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Microsoft Edge Chakra JIT - Bound Check Elimination Bug Exploit [dos #exploits #0day #Exploit]

  Tags:   

• 8:05

  #0daytoday #DynoRoot DHCP - Client Command Injection Exploit CVE-2018-1111 [remote #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #DynoRoot DHCP - Client Command Injection Exploit CVE-2018-1111 [remote #exploits #0day #Exploit]

  Tags:   

• 8:05

  #0daytoday #HPE iMC 7.3 - Remote Code Execution Exploit [remote #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #HPE iMC 7.3 - Remote Code Execution Exploit [remote #exploits #0day #Exploit]

  Tags:   

• 8:05

  #0daytoday #Jenkins CLI - HTTP Java Deserialization Exploit CVE-2016-9299 [remote #exploits #0day #Exploit]

   » ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)
  #0daytoday #Jenkins CLI - HTTP Java Deserialization Exploit CVE-2016-9299 [remote #exploits #0day #Exploit]

  Tags:   

• 8:03

  Arduino Just Introduced an FPGA Board, Announces Debugging and Better Software

   » ‎ Hack a Day

  Today ahead of the Bay Area Maker Faire, Arduino has announced a bevy of new boards that bring modern features and modern chips to the Arduino ecosystem.

  Most ambitious of these new offerings is a board that combines a fast ARM microcontroller, WiFi, Bluetooth, and an FPGA. All this is wrapped in a package that provides Mini HDMI out and pins for a PCIe-Express slot. They’re calling it the Arduino MKR Vidor 4000.

  Bringing an FPGA to the Arduino ecosystem is on the list of the most interesting advances in DIY electronics in recent memory, and there’s a lot to …read more

  Tags:  arduino hacks  

• 7:44

  HPE iMC 7.3 Remote Code Execution

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits an expression language injection vulnerability, along with an authentication bypass vulnerability in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04 to achieve remote code execution. The HP iMC server suffers from multiple vulnerabilities allows unauthenticated attacker to execute arbitrary Expression Language via the beanName parameter, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 8080 and 8443 by default. This Metasploit module has been tested successfully on iMC PLAT v7.3(E0504P02) on Windows 2k12r2 x64 (EN).

  Tags:   

• 7:44

  HPE iMC 7.3 Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits an expression language injection vulnerability, along with an authentication bypass vulnerability in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04 to achieve remote code execution. The HP iMC server suffers from multiple vulnerabilities allows unauthenticated attacker to execute arbitrary Expression Language via the beanName parameter, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 8080 and 8443 by default. This Metasploit module has been tested successfully on iMC PLAT v7.3(E0504P02) on Windows 2k12r2 x64 (EN).

  Tags:   

• 7:44

  HPE iMC 7.3 Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits an expression language injection vulnerability, along with an authentication bypass vulnerability in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04 to achieve remote code execution. The HP iMC server suffers from multiple vulnerabilities allows unauthenticated attacker to execute arbitrary Expression Language via the beanName parameter, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 8080 and 8443 by default. This Metasploit module has been tested successfully on iMC PLAT v7.3(E0504P02) on Windows 2k12r2 x64 (EN).

  Tags:   

• 7:32

  SAP B2B / B2C CRM Local File Inclusion

   » ‎ Packet Storm Security Exploits
  SAP B2B / B2C CRM versions 2.x up to 4.x suffer from a local file inclusion vulnerability.

  Tags:   

• 7:32

  SAP B2B / B2C CRM Local File Inclusion

   » ‎ Packet Storm Security Recent Files
  SAP B2B / B2C CRM versions 2.x up to 4.x suffer from a local file inclusion vulnerability.

  Tags:   

• 7:32

  SAP B2B / B2C CRM Local File Inclusion

   » ‎ Packet Storm Security Misc. Files
  SAP B2B / B2C CRM versions 2.x up to 4.x suffer from a local file inclusion vulnerability.

  Tags:   

• 7:02

  DynoRoot DHCP Command Injection

   » ‎ Packet Storm Security Exploits
  DynoRoot DHCP suffers from a client command injection vulnerability.

  Tags:   

• 7:02

  DynoRoot DHCP Command Injection

   » ‎ Packet Storm Security Recent Files
  DynoRoot DHCP suffers from a client command injection vulnerability.

  Tags:   

• 7:02

  DynoRoot DHCP Command Injection

   » ‎ Packet Storm Security Misc. Files
  DynoRoot DHCP suffers from a client command injection vulnerability.

  Tags:   

• 7:00

  Snowboard and Skateboard So Lit You Can Wipe Out and Still Look Good

   » ‎ Hack a Day

  [Nate] has made snowboarding cool with his Bluetooth connected board. Using 202 WS2812 LEDs carefully wrapped around the edge of the board and sealed with a conformal coating, it’s bright and waterproof. It’s controlled with an Arduino Nano and a Bluetooth classic board, as well as a large swappable USB battery bank; he can get roughly four hours of life at full brightness on his toy.

  Where it gets even cooler is with a six-axis gyro connected to the Nano, which tracks the board movement, and the lights respond accordingly, creating cool patterns based on his speed, angles, and other …read more

  Tags:  led hacks  

• 6:22

  Infinity Market Classified Ads Script 1.6.2 Cross Site Request Forgery

   » ‎ Packet Storm Security Exploits
  Infinity Market Classified Ads Script version 1.6.2 suffers from a cross site request forgery vulnerability.

  Tags:   

• 6:22

  Infinity Market Classified Ads Script 1.6.2 Cross Site Request Forgery

   » ‎ Packet Storm Security Recent Files
  Infinity Market Classified Ads Script version 1.6.2 suffers from a cross site request forgery vulnerability.

  Tags:   

• 6:22

  Infinity Market Classified Ads Script 1.6.2 Cross Site Request Forgery

   » ‎ Packet Storm Security Misc. Files
  Infinity Market Classified Ads Script version 1.6.2 suffers from a cross site request forgery vulnerability.

  Tags:   

• 6:02

  Prime95 29.4b8 Stack Buffer Overflow

   » ‎ Packet Storm Security Exploits
  Prime95 version 29.4b8 SEH buffer overflow exploit.

  Tags:   

• 6:02

  Prime95 29.4b8 Stack Buffer Overflow

   » ‎ Packet Storm Security Recent Files
  Prime95 version 29.4b8 SEH buffer overflow exploit.

  Tags:   

• 6:02

  Prime95 29.4b8 Stack Buffer Overflow

   » ‎ Packet Storm Security Misc. Files
  Prime95 version 29.4b8 SEH buffer overflow exploit.

  Tags:   

• 5:22

  Cisco SA520W Security Appliance Path Traversal

   » ‎ Packet Storm Security Exploits
  Cisco SA520W Security Appliance suffers from a path traversal vulnerability.

  Tags:   

• 5:22

  Cisco SA520W Security Appliance Path Traversal

   » ‎ Packet Storm Security Recent Files
  Cisco SA520W Security Appliance suffers from a path traversal vulnerability.

  Tags:   

• 5:22

  Cisco SA520W Security Appliance Path Traversal

   » ‎ Packet Storm Security Misc. Files
  Cisco SA520W Security Appliance suffers from a path traversal vulnerability.

  Tags:   

• 4:11

  Siemens SIMATIC Panels Cross Site Request Forgery / Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  Multiple Siemens SIMATIC panels suffer from cross site request forgery and cross site scripting vulnerabilities.

  Tags:   

• 4:11

  Siemens SIMATIC Panels Cross Site Request Forgery / Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  Multiple Siemens SIMATIC panels suffer from cross site request forgery and cross site scripting vulnerabilities.

  Tags:   

• 4:11

  Siemens SIMATIC Panels Cross Site Request Forgery / Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  Multiple Siemens SIMATIC panels suffer from cross site request forgery and cross site scripting vulnerabilities.

  Tags:   

• 4:00

  Open Source Calculator Teaches us about Quality Documentation

   » ‎ Hack a Day

  Graphing calculators are one of those funny markets that never seem to change. Standardized testing has created a primordial stew of regulatory capture in which ancient technology thrives at modern retail prices while changing little. The NumWorks calculator certainly isn’t the first competitor to challenge the Texas Instruments dynasty with a more modern interface (and a design from this decade), but behind it’s subtle color pops and elegant lines lies the real gem; a fantastically well documented piece of open source hardware. The last time we wrote about the NumWorks, it was to demonstrate a pretty wild hack that embedded …read more

  Tags:  handhelds hacks  

• 1:04

  Linux 4-Byte Information Leak

   » ‎ Packet Storm Security Exploits
  Linux suffers from a 4-byte information leak via an uninitialized struct field in the compat adjtimex syscall.

  Tags:   

• 1:04

  Linux 4-Byte Information Leak

   » ‎ Packet Storm Security Recent Files
  Linux suffers from a 4-byte information leak via an uninitialized struct field in the compat adjtimex syscall.

  Tags:   

• 1:04

  Linux 4-Byte Information Leak

   » ‎ Packet Storm Security Misc. Files
  Linux suffers from a 4-byte information leak via an uninitialized struct field in the compat adjtimex syscall.

  Tags:   

• 1:03

  Microsoft Edge Chakra JIT Bounce Check Elimination Bug

   » ‎ Packet Storm Security Exploits
  Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instead of the control flow. This may lead to incorrectly remove the bound checks.

  Tags:   

• 1:03

  Microsoft Edge Chakra JIT Bounce Check Elimination Bug

   » ‎ Packet Storm Security Recent Files
  Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instead of the control flow. This may lead to incorrectly remove the bound checks.

  Tags:   

• 1:03

  Microsoft Edge Chakra JIT Bounce Check Elimination Bug

   » ‎ Packet Storm Security Misc. Files
  Chakra uses the InvariantBlockBackwardIterator class to backpropagate the information about the hoisted bound checks. But the class follows the linked list instead of the control flow. This may lead to incorrectly remove the bound checks.

  Tags:   

• 1:01

  MagniComp SysInfo Information Exposure

   » ‎ Packet Storm Security Advisories
  MagniComp SysInfo contains an information exposure vulnerability through debug functionality.

  Tags:   

• 1:01

  MagniComp SysInfo Information Exposure

   » ‎ Packet Storm Security Recent Files
  MagniComp SysInfo contains an information exposure vulnerability through debug functionality.

  Tags:   

• 1:01

  MagniComp SysInfo Information Exposure

   » ‎ Packet Storm Security Misc. Files
  MagniComp SysInfo contains an information exposure vulnerability through debug functionality.

  Tags:   

• 1:00

  Five Steps to TensorFlow on the Raspberry Pi

   » ‎ Hack a Day

  If you have about 10 hours to kill, you can use [Edje Electronics’s] instructions to install TensorFlow on a Raspberry Pi 3. In all fairness, the amount of time you’ll have to babysit is about an hour. The rest of the time is spent building things and you don’t need to watch it going. You can see a video on the steps required below.

  You need the Pi with at least a 16 GB SD card and a USB drive with at least 1 GB of free space. This not only holds the software, but allows you to create a …read more

  Tags:  raspberry  

• 0:46

  Debian Security Advisory 4203-1

   » ‎ Packet Storm Security Advisories
  Debian Linux Security Advisory 4203-1 - Hans Jerry Illikainen discovered a type conversion vulnerability in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played.

  Tags:   

• 0:46

  Debian Security Advisory 4203-1

   » ‎ Packet Storm Security Recent Files
  Debian Linux Security Advisory 4203-1 - Hans Jerry Illikainen discovered a type conversion vulnerability in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played.

  Tags:   

• 0:46

  Debian Security Advisory 4203-1

   » ‎ Packet Storm Security Misc. Files
  Debian Linux Security Advisory 4203-1 - Hans Jerry Illikainen discovered a type conversion vulnerability in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played.

  Tags:   

• 0:43

  MEPs To Press Zuckerberg On Facebook Privacy

   » ‎ Packet Storm Security Headlines
  MEPs To Press Zuckerberg On Facebook Privacy

  Tags:  headlinegovernmentprivacyfacebook  

• 0:43

  Oh, Great, Now There's A Second Rowhammer Exploit

   » ‎ Packet Storm Security Headlines
  Oh, Great, Now There's A Second Rowhammer Exploit

  Tags:  headlineflawintel  

• 0:43

  Alleged CIA Leaker Joshua Schulte Has World's Worst Opsec

   » ‎ Packet Storm Security Headlines
  Alleged CIA Leaker Joshua Schulte Has World's Worst Opsec

  Tags:  headlinegovernmentusadata losscia  

• 0:43

  OpenSSH Arrives In Windows 10 Spring Update

   » ‎ Packet Storm Security Headlines
  OpenSSH Arrives In Windows 10 Spring Update

  Tags:  headlineprivacymicrosoftcryptography  

• 0:18

  MagniComp SysInfo Information Exposure [CVE-2018-7268]

   » ‎ Bugtraq

  Posted by Harry Sintonen on May 18

  MagniComp SysInfo Information Exposure [CVE-2018-7268]
  ======================================================
  The latest version of this advisory is available at:
  https://sintonen.fi/advisories/magnicomp-sysinfo-information-exposure.txt
  
  Overview
  --------
  
  MagniComp SysInfo contains a information exposure vulnerability through debug
  functionality.
  
  Description
  -----------
  
  Due to a combination of setuid binary and verbose debugging, MagniComp...
  

  Tags:   

• 0:12

  [SECURITY] [DSA 4203-1] vlc security update

   » ‎ Bugtraq

  Posted by Moritz Muehlenhoff on May 18

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-4203-1 security () debian org
  https://www.debian.org/security/ Moritz Muehlenhoff
  May 17, 2018 https://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : vlc
  CVE ID : CVE-2017-17670
  
  Hans Jerry Illikainen...
  

  Tags:   

• May 17, 2018
• 22:00

  Automatic MtG Card Sorter Separates Rags from Riches

   » ‎ Hack a Day

  Like many of us, [Michael Portera] was an avid trading card collector as a kid. Also like many of us, life got in the way, and the collections sat ignored in boxes until our mothers threatened to get rid of them (or skipped the threat altogether and sold them at a garage sale for next to nothing).

  [Michael] was recently reunited with his collection of Magic cards, which vary in value as much as baseball or any other kind of collectible card. Now that his Friday nights are otherwise occupied, he decided to sell them off. But first, he had …read more

  Tags:  raspberry  

• 21:44

  SAP NetWeaver Web Dynpro Information Disclosure

   » ‎ Packet Storm Security Exploits
  SAP NetWeaver Web Dynpro versions 6.4 up to 7.5 suffer from an information disclosure vulnerability.

  Tags:   

• 21:44

  SAP NetWeaver Web Dynpro Information Disclosure

   » ‎ Packet Storm Security Recent Files
  SAP NetWeaver Web Dynpro versions 6.4 up to 7.5 suffer from an information disclosure vulnerability.

  Tags:   

• 21:44

  SAP NetWeaver Web Dynpro Information Disclosure

   » ‎ Packet Storm Security Misc. Files
  SAP NetWeaver Web Dynpro versions 6.4 up to 7.5 suffer from an information disclosure vulnerability.

  Tags:   

• 20:33

  Monstra CMS Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  Monstra CMS versions prior to 3.0.4 suffer from a cross site scripting vulnerability.

  Tags:   

• 20:33

  Monstra CMS Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  Monstra CMS versions prior to 3.0.4 suffer from a cross site scripting vulnerability.

  Tags:   

• 20:33

  Monstra CMS Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  Monstra CMS versions prior to 3.0.4 suffer from a cross site scripting vulnerability.

  Tags:   

• 19:00

  DIY SSR For Mains Switching

   » ‎ Hack a Day

  Typical power strips have their sockets tightly spaced. This makes it cumbersome to connect devices whose wall warts or power bricks are bulky — you end up losing an adjoining socket or two. And if the strip has a single power switch, you cannot turn off individual devices without unplugging them.

  Planning to tackle both problems together, [Travis Hein] built himself some custom Dual SSR Controlled Socket Outlets for his workbench. He also decided to add remote switching ability so he could turn off individual sockets via a controller, Raspberry Pi, smartphone app or most ideally, a nice control panel …read more

  Tags:  Hardware  

• 17:00

  [webapps] Healwire Online Pharmacy 3.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery

   » ‎ Exploit-DB
  Healwire Online Pharmacy 3.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery

  Tags:   

• 17:00

  [webapps] Monstra CMS before 3.0.4 - Cross-Site Scripting

   » ‎ Exploit-DB
  Monstra CMS before 3.0.4 - Cross-Site Scripting

  Tags:   

• 17:00

  [webapps] SAP NetWeaver Web Dynpro 6.4 to 7.5 - Information disclosure

   » ‎ Exploit-DB
  SAP NetWeaver Web Dynpro 6.4

  Tags:   

• 17:00

  [remote] HPE iMC 7.3 - Remote Code Execution (Metasploit)

   » ‎ Exploit-DB
  HPE iMC 7.3 - Remote Code Execution (Metasploit)

  Tags:   

• 17:00

  [local] Prime95 29.4b8 - Stack Buffer Overflow (SEH)

   » ‎ Exploit-DB
  Prime95 29.4b8 - Stack Buffer Overflow (SEH)

  Tags:   

• 17:00

  [webapps] Infinity Market Classified Ads Script 1.6.2 - Cross-Site Request Forgery

   » ‎ Exploit-DB
  Infinity Market Classified Ads Script 1.6.2 - Cross-Site Request Forgery

  Tags:   

• 17:00

  [webapps] Cisco SA520W Security Appliance - Path Traversal

   » ‎ Exploit-DB
  Cisco SA520W Security Appliance - Path Traversal

  Tags:   

• 17:00

  [local] DynoRoot DHCP - Client Command Injection

   » ‎ Exploit-DB
  DynoRoot DHCP - Client Command Injection

  Tags:   

• 17:00

  [local] Linux 4.8.0 < 4.8.0-46 - AF_PACKET packet_set_ring Privilege Escalation (Metasploit)

   » ‎ Exploit-DB
  Linux 4.8.0

  Tags:   

• 17:00

  [dos] Microsoft Edge Chakra JIT - Bound Check Elimination Bug

   » ‎ Exploit-DB
  Microsoft Edge Chakra JIT - Bound Check Elimination Bug

  Tags:   

• 17:00

  [webapps] SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion

   » ‎ Exploit-DB
  SAP B2B / B2C CRM 2.x

  Tags:   

• 16:01

  Suitcase Computer Reborn with Raspberry Pi Inside

   » ‎ Hack a Day

  Fun fact, the Osborne 1 debuted with a price tag equivalent to about $5,000 in today’s value. With a gigantic 9″ screen and twin floppy drives (for making mix tapes, right?) the real miracle of the machine was its portability, something unheard of at the time. The retrocomputing trend is to lovingly and carefully restore these old machines to their former glory, regardless of how clunky or underpowered they are by modern standards. But sometimes they can’t be saved yet it’s still possible to gut and rebuild the machine with modern hardware, like with this Raspberry Pi used to revive …read more

  Tags:  raspberry  

• 13:42

  AF_PACKET packet_set_ring Privilege Escalation

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits a heap-out-of-bounds write in the packet_set_ring function in net/packet/af_packet.c (AF_PACKET) in the Linux kernel to execute code as root (CVE-2017-7308). The bug was initially introduced in 2011 and patched in version 4.10.6, potentially affecting a large number of kernels; however this exploit targets only systems using Ubuntu Xenial kernels 4.8.0

  Tags:   

• 13:42

  AF_PACKET packet_set_ring Privilege Escalation

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits a heap-out-of-bounds write in the packet_set_ring function in net/packet/af_packet.c (AF_PACKET) in the Linux kernel to execute code as root (CVE-2017-7308). The bug was initially introduced in 2011 and patched in version 4.10.6, potentially affecting a large number of kernels; however this exploit targets only systems using Ubuntu Xenial kernels 4.8.0

  Tags:   

• 13:42

  AF_PACKET packet_set_ring Privilege Escalation

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits a heap-out-of-bounds write in the packet_set_ring function in net/packet/af_packet.c (AF_PACKET) in the Linux kernel to execute code as root (CVE-2017-7308). The bug was initially introduced in 2011 and patched in version 4.10.6, potentially affecting a large number of kernels; however this exploit targets only systems using Ubuntu Xenial kernels 4.8.0

  Tags:   

• 13:27

  Red Hat Security Advisory 2018-1609-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2018-1609-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. Issues addressed include a privilege escalation vulnerability.

  Tags:   

• 13:27

  Red Hat Security Advisory 2018-1609-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2018-1609-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. Issues addressed include a privilege escalation vulnerability.

  Tags:   

• 13:27

  Red Hat Security Advisory 2018-1609-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2018-1609-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. Issues addressed include a privilege escalation vulnerability.

  Tags:   

• 13:27

  Slackware Security Advisory - php Updates

   » ‎ Packet Storm Security Advisories
  Slackware Security Advisory - New php packages are available for Slackware 14.0, 14.1, and 14.2 to fix security issues.

  Tags:   

• 13:27

  Slackware Security Advisory - php Updates

   » ‎ Packet Storm Security Recent Files
  Slackware Security Advisory - New php packages are available for Slackware 14.0, 14.1, and 14.2 to fix security issues.

  Tags:   

• 13:27

  Slackware Security Advisory - php Updates

   » ‎ Packet Storm Security Misc. Files
  Slackware Security Advisory - New php packages are available for Slackware 14.0, 14.1, and 14.2 to fix security issues.

  Tags:   

• 13:25

  Intelbras NCLOUD 300 1.0 Authentication Bypass

   » ‎ Packet Storm Security Exploits
  Intelbras NCLOUD 300 version 1.0 suffers from an authentication bypass vulnerability.

  Tags:   

• 13:25

  Intelbras NCLOUD 300 1.0 Authentication Bypass

   » ‎ Packet Storm Security Recent Files
  Intelbras NCLOUD 300 version 1.0 suffers from an authentication bypass vulnerability.

  Tags:   

• 13:25

  Intelbras NCLOUD 300 1.0 Authentication Bypass

   » ‎ Packet Storm Security Misc. Files
  Intelbras NCLOUD 300 version 1.0 suffers from an authentication bypass vulnerability.

  Tags:   

• 13:24

  Red Hat Security Advisory 2018-1607-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2018-1607-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous patch is a security update for JBoss invoker in Red Hat JBoss Enterprise Application Platform 5.2.0. Issues addressed include a code execution vulnerability.

  Tags:   

• 13:24

  Red Hat Security Advisory 2018-1607-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2018-1607-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous patch is a security update for JBoss invoker in Red Hat JBoss Enterprise Application Platform 5.2.0. Issues addressed include a code execution vulnerability.

  Tags:   

• 13:24

  Red Hat Security Advisory 2018-1607-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2018-1607-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous patch is a security update for JBoss invoker in Red Hat JBoss Enterprise Application Platform 5.2.0. Issues addressed include a code execution vulnerability.

  Tags:   

• 13:23

  Red Hat Security Advisory 2018-1593-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2018-1593-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 13:23

  Red Hat Security Advisory 2018-1593-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2018-1593-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 13:23

  Red Hat Security Advisory 2018-1593-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2018-1593-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 13:23

  Slackware Security Advisory - curl Updates

   » ‎ Packet Storm Security Advisories
  Slackware Security Advisory - New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

  Tags:   

• 13:23

  Slackware Security Advisory - curl Updates

   » ‎ Packet Storm Security Recent Files
  Slackware Security Advisory - New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

  Tags:   

• 13:23

  Slackware Security Advisory - curl Updates

   » ‎ Packet Storm Security Misc. Files
  Slackware Security Advisory - New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

  Tags:   

• 13:20

  Nanopool Claymore Dual Miner 7.3 Remote Code Execution

   » ‎ Packet Storm Security Exploits
  Nanopool Claymore Dual Miner version 7.3 suffers from a remote code execution vulnerability.

  Tags:   

• 13:20

  Nanopool Claymore Dual Miner 7.3 Remote Code Execution

   » ‎ Packet Storm Security Recent Files
  Nanopool Claymore Dual Miner version 7.3 suffers from a remote code execution vulnerability.

  Tags:   

• 13:20

  Nanopool Claymore Dual Miner 7.3 Remote Code Execution

   » ‎ Packet Storm Security Misc. Files
  Nanopool Claymore Dual Miner version 7.3 suffers from a remote code execution vulnerability.

  Tags:   

• 13:18

  Powerlogic/Schneider Electric IONXXXX Series Cross Site Request Forgery

   » ‎ Packet Storm Security Exploits
  Powerlogic/Schneider Electric IONXXXX Series suffers from a cross site request forgery vulnerability.

  Tags:   

• 13:18

  Powerlogic/Schneider Electric IONXXXX Series Cross Site Request Forgery

   » ‎ Packet Storm Security Recent Files
  Powerlogic/Schneider Electric IONXXXX Series suffers from a cross site request forgery vulnerability.

  Tags:   

• 13:18

  Powerlogic/Schneider Electric IONXXXX Series Cross Site Request Forgery

   » ‎ Packet Storm Security Misc. Files
  Powerlogic/Schneider Electric IONXXXX Series suffers from a cross site request forgery vulnerability.

  Tags:   

• 13:15

  Red Hat Security Advisory 2018-1608-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2018-1608-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous patch is a security update for JBoss invoker in Red Hat JBoss Enterprise Application Platform 5.2.0. Issues addressed include a code execution vulnerability.

  Tags:   

• 13:15

  Red Hat Security Advisory 2018-1608-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2018-1608-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous patch is a security update for JBoss invoker in Red Hat JBoss Enterprise Application Platform 5.2.0. Issues addressed include a code execution vulnerability.

  Tags:   

• 13:15

  Red Hat Security Advisory 2018-1608-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2018-1608-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchronous patch is a security update for JBoss invoker in Red Hat JBoss Enterprise Application Platform 5.2.0. Issues addressed include a code execution vulnerability.

  Tags:   

• 13:14

  Red Hat Security Advisory 2018-1593-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2018-1593-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 13:14

  Red Hat Security Advisory 2018-1593-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2018-1593-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 13:14

  Red Hat Security Advisory 2018-1593-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2018-1593-01 - Red Hat OpenStack Platform director provides the facilities for deploying and monitoring a private or public infrastructure-as-a-service cloud based on Red Hat OpenStack Platform. Issues addressed include a denial of service vulnerability.

  Tags:   

• 13:13

  SuperCom Online Shopping Ecommerce Cart 1 XSS / CSRF / SQL Injection

   » ‎ Packet Storm Security Exploits
  SuperCom Online Shopping Ecommerce Cart 1 suffers from remote SQL injection, cross site request forgery, and cross site scripting vulnerabilities.

  Tags:   

• 13:13

  SuperCom Online Shopping Ecommerce Cart 1 XSS / CSRF / SQL Injection

   » ‎ Packet Storm Security Recent Files
  SuperCom Online Shopping Ecommerce Cart 1 suffers from remote SQL injection, cross site request forgery, and cross site scripting vulnerabilities.

  Tags:   

• 13:13

  SuperCom Online Shopping Ecommerce Cart 1 XSS / CSRF / SQL Injection

   » ‎ Packet Storm Security Misc. Files
  SuperCom Online Shopping Ecommerce Cart 1 suffers from remote SQL injection, cross site request forgery, and cross site scripting vulnerabilities.

  Tags:   

• 13:10

  NodAPS 4.0 Cross Site Request Forgery / SQL Injection

   » ‎ Packet Storm Security Exploits
  NodAPS version 4.0 suffers from cross site request forgery and remote SQL injection vulnerabilities.

  Tags:   

• 13:10

  NodAPS 4.0 Cross Site Request Forgery / SQL Injection

   » ‎ Packet Storm Security Recent Files
  NodAPS version 4.0 suffers from cross site request forgery and remote SQL injection vulnerabilities.

  Tags:   

• 13:10

  NodAPS 4.0 Cross Site Request Forgery / SQL Injection

   » ‎ Packet Storm Security Misc. Files
  NodAPS version 4.0 suffers from cross site request forgery and remote SQL injection vulnerabilities.

  Tags:   

• 13:07

  Red Hat Security Advisory 2018-1605-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2018-1605-01 - Red Hat OpenStack Platform Operational Tools provides the facilities for monitoring a private or public Red Hat OpenStack Platform cloud. collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD files. Because the daemon does not start up each time it updates files, it has a low system footprint. Security fix: collectd: double free in csnmp_read_table function in snmp.c.

  Tags:   

• 13:07

  Red Hat Security Advisory 2018-1605-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2018-1605-01 - Red Hat OpenStack Platform Operational Tools provides the facilities for monitoring a private or public Red Hat OpenStack Platform cloud. collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD files. Because the daemon does not start up each time it updates files, it has a low system footprint. Security fix: collectd: double free in csnmp_read_table function in snmp.c.

  Tags:   

• 13:07

  Red Hat Security Advisory 2018-1605-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2018-1605-01 - Red Hat OpenStack Platform Operational Tools provides the facilities for monitoring a private or public Red Hat OpenStack Platform cloud. collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD files. Because the daemon does not start up each time it updates files, it has a low system footprint. Security fix: collectd: double free in csnmp_read_table function in snmp.c.

  Tags:   

• 13:06

  Red Hat Security Advisory 2018-1606-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2018-1606-01 - Sensu is a monitoring framework that aims to be simple, malleable, and scalable. Security fix: Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data structures, resulting in sensitive data, such as passwords, being logged in clear-text. For more details about the security issue, including the impact, a CVSS score, and other related information, refer to the CVE page listed in the References section. Issues addressed include a failed redaction issue.

  Tags:   

• 13:06

  Red Hat Security Advisory 2018-1606-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2018-1606-01 - Sensu is a monitoring framework that aims to be simple, malleable, and scalable. Security fix: Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data structures, resulting in sensitive data, such as passwords, being logged in clear-text. For more details about the security issue, including the impact, a CVSS score, and other related information, refer to the CVE page listed in the References section. Issues addressed include a failed redaction issue.

  Tags:   

• 13:06

  Red Hat Security Advisory 2018-1606-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2018-1606-01 - Sensu is a monitoring framework that aims to be simple, malleable, and scalable. Security fix: Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data structures, resulting in sensitive data, such as passwords, being logged in clear-text. For more details about the security issue, including the impact, a CVSS score, and other related information, refer to the CVE page listed in the References section. Issues addressed include a failed redaction issue.

  Tags:   

• 13:06

  Debian Security Advisory 4202-1

   » ‎ Packet Storm Security Advisories
  Debian Linux Security Advisory 4202-1 - OSS-fuzz, assisted by Max Dymond, discovered that cURL, an URL transfer library, could be tricked into reading data beyond the end of a heap based buffer when parsing invalid headers in an RTSP response.

  Tags:   

• 13:06

  Debian Security Advisory 4202-1

   » ‎ Packet Storm Security Recent Files
  Debian Linux Security Advisory 4202-1 - OSS-fuzz, assisted by Max Dymond, discovered that cURL, an URL transfer library, could be tricked into reading data beyond the end of a heap based buffer when parsing invalid headers in an RTSP response.

  Tags:   

• 13:06

  Debian Security Advisory 4202-1

   » ‎ Packet Storm Security Misc. Files
  Debian Linux Security Advisory 4202-1 - OSS-fuzz, assisted by Max Dymond, discovered that cURL, an URL transfer library, could be tricked into reading data beyond the end of a heap based buffer when parsing invalid headers in an RTSP response.

  Tags:   

• 13:01

  No-Battery HD Video Streaming Does It with Backscatter

   » ‎ Hack a Day

  What if Google Glass didn’t have a battery? That’s not too far fetched. This battery-free HD video streaming camera could be built into a pair of eyeglass frames to stream HD video to a nearby phone or other receiver using no bulky batteries or external power source. Researchers at the University of Washington are using backscatter to pull this off.

  The problem is that a camera which streams HD video wirelessly to a receiver consumes over 1 watt due to the need for a digital processor and transmitter. The researchers have separated the processing hardware into the receiving unit. They …read more

  Tags:  video hacks  

• 11:30

  The Solid State Weather Station

   » ‎ Hack a Day

  Building personal weather stations has become easier now than ever before, thanks to all the improvements in sensors, electronics, and prototyping techniques. The availability of cheap networking modules allows us to make sure these IoT devices can transmit their information to public databases, thereby providing local communities with relevant weather data about their immediate surroundings.

  [Manolis Nikiforakis] is attempting to build the Weather Pyramid — a completely solid-state, maintenance free, energy and communications autonomous weather sensing device, designed for mass scale deployment. Typically, a weather station has sensors for measuring temperature, pressure, humidity, wind speed and rainfall. While most of …read more

  Tags:  the hackaday prize  

• 10:01

  Circuit VR: Current Mirrors

   » ‎ Hack a Day

  Last time we looked at Spice models of a current sink. We didn’t look at some of the problems involved with a simple sink, and for many practical applications, they are perfectly adequate. However, you’ll often see more devices used to improve the characteristics of the current sink or source. In particular, a common design is a current mirror which copies a current from one device to another. Usually, the device that sets the current is in a configuration that makes it very stable while the other device handles the load current.

  For example, some transistor parameters vary based on …read more

  Tags:  engineering  

• 8:30

  The Pros and Cons of Microcontrollers for Boost Converters

   » ‎ Hack a Day

  It never fails — we post a somewhat simple project using a microcontroller and someone points out that it could have been accomplished better with a 555 timer or discrete transistors or even a couple of vacuum tubes. We welcome the critiques, of course; after all, thoughtful feedback is the point of the comment section. Sometimes the anti-Arduino crowd has a point, but as [Great Scott!] demonstrates with this microcontroller-less boost converter, other times it just makes sense to code your way out of a problem.

  Built mainly as a comeback to naysayers on his original boost-converter circuit, which relied …read more

  Tags:  microcontrollers