< Back to JetLib.com

jetlib.sec

Feeds

267284 items (161 unread) in 27 feeds

« Expand/Collapse

Recent items

Skip to page: 1 2 3 4 ... 929

August 30, 2021
12:05
#0daytoday #Strapi 3.0.0-beta.17.7 - Remote Code Execution (Authenticated) Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Strapi 3.0.0-beta.17.7 - Remote Code Execution (Authenticated) Exploit [#0day #Exploit]
Tags:
12:05
#0daytoday #Strapi 3.0.0-beta - Set Password (Unauthenticated) Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Strapi 3.0.0-beta - Set Password (Unauthenticated) Exploit [webapps #exploits #0day #Exploit]
Tags:
12:05
#0daytoday #MySQL User-Defined (Linux) x32 / x86_64 - (sys_exec) Local Privilege Escalation Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #MySQL User-Defined (Linux) x32 / x86_64 - (sys_exec) Local Privilege Escalation Exploit [#0day #Exploit]
Tags:
9:52
#0daytoday #Bus Pass Management System 1.0 - (viewid) SQL Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Bus Pass Management System 1.0 - (viewid) SQL Injection Vulnerability [#0day #Exploit]
Tags:
9:52
#0daytoday #Usermin 1.820 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Usermin 1.820 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
Tags:
9:52
#0daytoday #ZesleCP 3.1.9 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #ZesleCP 3.1.9 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
Tags:
August 27, 2021
7:03
#0daytoday #COMMAX UMS Client ActiveX Control 1.7.0.2 - (CNC_Ctrl.dll) Heap Buffer Overflow Vulnera [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COMMAX UMS Client ActiveX Control 1.7.0.2 - (CNC_Ctrl.dll) Heap Buffer Overflow Vulnera [#0day #Exploit]
Tags:
7:03
#0daytoday #COMMAX WebViewer ActiveX Control 2.1.4.5 - (Commax_WebViewer.ocx) Buffer Overflow Vulne [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COMMAX WebViewer ActiveX Control 2.1.4.5 - (Commax_WebViewer.ocx) Buffer Overflow Vulne [#0day #Exploit]
Tags:
7:03
#0daytoday #CyberPanel 2.1 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #CyberPanel 2.1 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
Tags:
August 26, 2021
5:43
#0daytoday #ProcessMaker 3.5.4 - Local File inclusion Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #ProcessMaker 3.5.4 - Local File inclusion Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
August 25, 2021
7:15
#0daytoday #Online Leave Management System 1.0 - Arbitrary File Upload to Shell (Unauthenticated) E [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Online Leave Management System 1.0 - Arbitrary File Upload to Shell (Unauthenticated) E [#0day #Exploit]
Tags:
7:15
#0daytoday #HP OfficeJet 4630/7110 MYM1FN2025AR/2117A - Stored Cross-Site Scripting Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #HP OfficeJet 4630/7110 MYM1FN2025AR/2117A - Stored Cross-Site Scripting Exploit [#0day #Exploit]
Tags:
7:15
#0daytoday #WordPress Mail Masta 1.0 Plugin - Local File Inclusion Exploit (2) [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress Mail Masta 1.0 Plugin - Local File Inclusion Exploit (2) [webapps #exploits #0day #Exploit]
Tags:
August 24, 2021
9:31
#0daytoday #Moodle Pre-Auth Remote Code Execution 0day Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Moodle Pre-Auth Remote Code Execution 0day Exploit [webapps #exploits #0day #Exploit]
Tags:
6:04
#0daytoday #Shoutcast Server 2.6.0.753 Crash Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Shoutcast Server 2.6.0.753 Crash Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
August 23, 2021
0:27
#0daytoday #RaspAP 2.6.6 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #RaspAP 2.6.6 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
Tags:
0:27
#0daytoday #Simple Phone book/directory 1.0 - (Username) SQL Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Simple Phone book/directory 1.0 - (Username) SQL Injection Vulnerability [#0day #Exploit]
Tags:
0:27
#0daytoday #Online Traffic Offense Management System 1.0 - Remote Code Execution (Unauthenticated) [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Online Traffic Offense Management System 1.0 - Remote Code Execution (Unauthenticated) [#0day #Exploit]
Tags:
August 21, 2021
4:19
#0daytoday #Microsoft Exchange ProxyShell Remote Code Execution Exploit [remote #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Microsoft Exchange ProxyShell Remote Code Execution Exploit [remote #exploits #0day #Exploit]
Tags:
4:19
#0daytoday #NetModule Router Software Password Handling / Session Fixation Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #NetModule Router Software Password Handling / Session Fixation Vulnerability [#0day #Exploit]
Tags:
4:19
#0daytoday #Laundry Booking Management System 1.0 - Multiple Stored Cross-Site Scripting Vulnerabil [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Laundry Booking Management System 1.0 - Multiple Stored Cross-Site Scripting Vulnerabil [#0day #Exploit]
Tags:
4:19
#0daytoday #Laundry Booking Management System 1.0 - Multiple SQL Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Laundry Booking Management System 1.0 - Multiple SQL Injection Vulnerability [#0day #Exploit]
Tags:
4:19
#0daytoday #Online Traffic Offense Management System 1.0 - (id) SQL Injection (Authenticated) Vulne [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Online Traffic Offense Management System 1.0 - (id) SQL Injection (Authenticated) Vulne [#0day #Exploit]
Tags:
August 19, 2021
10:13
#0daytoday #Charity Management System CMS 1.0 - Multiple Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Charity Management System CMS 1.0 - Multiple Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]
Tags:
0:12
#0daytoday #Altus Sistemas de Automacao Products CSRF / Command Injection / Hardcoded Credentials V [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Altus Sistemas de Automacao Products CSRF / Command Injection / Hardcoded Credentials V [#0day #Exploit]
Tags:
August 18, 2021
23:55
#0daytoday #WebKit WebCore::FrameLoader::PolicyChecker::checkNavigationPolicy Heap Use-After-Free V [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WebKit WebCore::FrameLoader::PolicyChecker::checkNavigationPolicy Heap Use-After-Free V [#0day #Exploit]
Tags:
3:29
#0daytoday #Lucee Administrator imgProcess.cfm Arbitrary File Write Exploit [remote #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Lucee Administrator imgProcess.cfm Arbitrary File Write Exploit [remote #exploits #0day #Exploit]
Tags:
2:58
#0daytoday #crossfire-server 1.9.0 - SetUp() Remote Buffer Overflow Exploit [remote #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #crossfire-server 1.9.0 - SetUp() Remote Buffer Overflow Exploit [remote #exploits #0day #Exploit]
Tags:
2:58
#0daytoday #COVID19 Testing Management System 1.0 - Multiple SQL Injections Vulnerabilities [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COVID19 Testing Management System 1.0 - Multiple SQL Injections Vulnerabilities [#0day #Exploit]
Tags:
2:58
#0daytoday #Simple Image Gallery 1.0 - Remote Code Execution (Unauthenticated) Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Simple Image Gallery 1.0 - Remote Code Execution (Unauthenticated) Exploit [#0day #Exploit]
Tags:
2:58
#0daytoday #Crime records Management System 1.0 - Multiple SQL Injection (Authenticated) Vulnerabil [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Crime records Management System 1.0 - Multiple SQL Injection (Authenticated) Vulnerabil [#0day #Exploit]
Tags:
August 17, 2021
2:23
#0daytoday #SonicWall NetExtender 10.2.0.300 - Unquoted Service Path Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #SonicWall NetExtender 10.2.0.300 - Unquoted Service Path Vulnerability [#0day #Exploit]
Tags:
2:22
#0daytoday #GeoVision Geowebserver 5.3.3 - LFI / XSS / HHI / RCE Vulnerabilities [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #GeoVision Geowebserver 5.3.3 - LFI / XSS / HHI / RCE Vulnerabilities [#0day #Exploit]
Tags:
August 16, 2021
2:30
#0daytoday #COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure Vulnerability [#0day #Exploit]
Tags:
2:29
#0daytoday #COMMAX Smart Home Ruvie CCTV Bridge DVR Service - Config Write / DoS (Unauthenticated) [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COMMAX Smart Home Ruvie CCTV Bridge DVR Service - Config Write / DoS (Unauthenticated) [#0day #Exploit]
Tags:
2:28
#0daytoday #COMMAX Smart Home Ruvie CCTV Bridge DVR Service - RTSP Credentials Disclosure Vulnerabi [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COMMAX Smart Home Ruvie CCTV Bridge DVR Service - RTSP Credentials Disclosure Vulnerabi [#0day #Exploit]
Tags:
2:27
#0daytoday #COMMAX Smart Home IoT Control System CDP-1020n - SQL Injection Authentication Bypass Vu [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COMMAX Smart Home IoT Control System CDP-1020n - SQL Injection Authentication Bypass Vu [#0day #Exploit]
Tags:
2:26
#0daytoday #COMMAX Biometric Access Control System 1.0.0 - Authentication Bypass Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COMMAX Biometric Access Control System 1.0.0 - Authentication Bypass Vulnerability [#0day #Exploit]
Tags:
2:25
#0daytoday #Simple Water Refilling Station Management System 1.0 - Remote Code Execution through Fi [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Simple Water Refilling Station Management System 1.0 - Remote Code Execution through Fi [#0day #Exploit]
Tags:
2:24
#0daytoday #Simple Water Refilling Station Management System 1.0 - Authentication Bypass Vulnerabil [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Simple Water Refilling Station Management System 1.0 - Authentication Bypass Vulnerabil [#0day #Exploit]
Tags:
2:23
#0daytoday #NetGear D1500 V1.0.0.21_1.0.1PE - (Wireless Repeater) Stored Cross-Site Scripting Vulne [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #NetGear D1500 V1.0.0.21_1.0.1PE - (Wireless Repeater) Stored Cross-Site Scripting Vulne [#0day #Exploit]
Tags:
2:22
#0daytoday #CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting Vulnerability [#0day #Exploit]
Tags:
August 13, 2021
2:24
#0daytoday #RATES SYSTEM 1.0 - Authentication Bypass Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #RATES SYSTEM 1.0 - Authentication Bypass Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
2:23
#0daytoday #Simple Image Gallery System 1.0 - (id) SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Simple Image Gallery System 1.0 - (id) SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
2:22
#0daytoday #Care2x Open Source Hospital Information Management 2.7 Alpha - Multiple Stored XSS Vuln [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Care2x Open Source Hospital Information Management 2.7 Alpha - Multiple Stored XSS Vuln [#0day #Exploit]
Tags:
2:22
#0daytoday #Police Crime Record Management System 1.0 - (casedetails) SQL Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Police Crime Record Management System 1.0 - (casedetails) SQL Injection Vulnerability [#0day #Exploit]
Tags:
1:54
#0daytoday #easy-mock 1.6.0 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #easy-mock 1.6.0 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
Tags:
1:53
#0daytoday #Police Crime Record Management System 1.0 - Multiple Stored Cross-Site Scripting Vulne [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Police Crime Record Management System 1.0 - Multiple Stored Cross-Site Scripting Vulne [#0day #Exploit]
Tags:
0:58
#0daytoday #4images 1.8 - (limitnumber) SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #4images 1.8 - (limitnumber) SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:

August 12, 2021
8:34
Windows 10: Microsoft Just Revealed Another Print Spooler Bug
» ‎ Packet Storm Security Headlines

Windows 10: Microsoft Just Revealed Another Print Spooler Bug
Tags:

0:58
#0daytoday #RATES SYSTEM 1.0 - (Multiple) SQL Injections Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #RATES SYSTEM 1.0 - (Multiple) SQL Injections Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]
Tags:
0:58
#0daytoday #Altova MobileTogether Server 7.3 - XML External Entity Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Altova MobileTogether Server 7.3 - XML External Entity Injection Vulnerability [#0day #Exploit]
Tags:
0:58
#0daytoday #COVID19 Testing Management System 1.0 - (searchdata) SQL Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #COVID19 Testing Management System 1.0 - (searchdata) SQL Injection Vulnerability [#0day #Exploit]
Tags:
August 10, 2021
0:58
#0daytoday #Simple Library Management System 1.0 - (rollno) SQL Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Simple Library Management System 1.0 - (rollno) SQL Injection Vulnerability [#0day #Exploit]
Tags:
0:58
#0daytoday #Xiaomi browser 10.2.4.g - Browser Search History Disclosure Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Xiaomi browser 10.2.4.g - Browser Search History Disclosure Vulnerability [#0day #Exploit]
Tags:
0:58
#0daytoday #WordPress Picture Gallery 1.4.2 Plugin - (Edit Content URL) Stored Cross-Site Scripting [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress Picture Gallery 1.4.2 Plugin - (Edit Content URL) Stored Cross-Site Scripting [#0day #Exploit]
Tags:
0:58
#0daytoday #WordPress LifterLMS 4.21.1 Plugin - Access Other Student Grades/Answers via IDOR Vulner [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress LifterLMS 4.21.1 Plugin - Access Other Student Grades/Answers via IDOR Vulner [#0day #Exploit]
Tags:
0:58
#0daytoday #Cockpit CMS 0.11.1 - (Username Enumeration & Password Reset) NoSQL Injectio [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Cockpit CMS 0.11.1 - (Username Enumeration & Password Reset) NoSQL Injectio [#0day #Exploit]
Tags:
0:58
#0daytoday #Amica Prodigy 1.7 - Privilege Escalation Vulnerability [remote #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Amica Prodigy 1.7 - Privilege Escalation Vulnerability [remote #exploits #Vulnerability #0day #Exploit]
Tags:
0:58
#0daytoday #IPCop 2.1.9 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #IPCop 2.1.9 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
Tags:
August 05, 2021
4:35
#0daytoday #Riak Insecure Default Configuration / Remote Command Execution Vulnerabilities [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Riak Insecure Default Configuration / Remote Command Execution Vulnerabilities [#0day #Exploit]
Tags:
3:54
#0daytoday #GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload (Unauthenticated) E [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload (Unauthenticated) E [#0day #Exploit]
Tags:
3:54
#0daytoday #Moodle 3.9 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Moodle 3.9 - Remote Code Execution (Authenticated) Exploit [webapps #exploits #0day #Exploit]
Tags:
3:54
#0daytoday #CMSuno 1.7 - (tgo) Stored Cross-Site Scripting (Authenticated) Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #CMSuno 1.7 - (tgo) Stored Cross-Site Scripting (Authenticated) Vulnerability [#0day #Exploit]
Tags:
August 04, 2021
5:23
#0daytoday #ApacheOfBiz 17.12.01 - Remote Command Execution via Unsafe Deserialization of XMLRPC ar [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #ApacheOfBiz 17.12.01 - Remote Command Execution via Unsafe Deserialization of XMLRPC ar [#0day #Exploit]
Tags:
5:23
#0daytoday #Client Management System 1.1 - (cname) Stored Cross-site scripting Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Client Management System 1.1 - (cname) Stored Cross-site scripting Vulnerability [#0day #Exploit]
Tags:
5:23
#0daytoday #qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated) Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated) Vulnerability [#0day #Exploit]
Tags:
5:23
#0daytoday #qdPM 9.1 - Remote Code Execution (Authenticated) Exploit CVE-2020-7246 [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #qdPM 9.1 - Remote Code Execution (Authenticated) Exploit CVE-2020-7246 [webapps #exploits #0day #Exploit]
Tags:
5:23
#0daytoday #WordPress WP Customize Login 1.1 Plugin - (Change Logo Title) Stored Cross-Site Scripti [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress WP Customize Login 1.1 Plugin - (Change Logo Title) Stored Cross-Site Scripti [#0day #Exploit]
Tags:
August 03, 2021
5:44
#0daytoday #Hotel Management System 1.0 - XSS Arbitrary File Upload Remote Code Execution Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Hotel Management System 1.0 - XSS Arbitrary File Upload Remote Code Execution Exploit [#0day #Exploit]
Tags:
August 01, 2021
4:10
#0daytoday #Online Hotel Reservation System 1.0 - (Multiple) Cross-site scripting Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Online Hotel Reservation System 1.0 - (Multiple) Cross-site scripting Vulnerability [#0day #Exploit]
Tags:
4:10
#0daytoday #Neo4j 3.4.18 - RMI based Remote Code Execution Exploit [remote #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Neo4j 3.4.18 - RMI based Remote Code Execution Exploit [remote #exploits #0day #Exploit]
Tags:
4:10
#0daytoday #Men Salon Management System 1.0 - SQL Injection Authentication Bypass Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Men Salon Management System 1.0 - SQL Injection Authentication Bypass Vulnerability [#0day #Exploit]
Tags:
July 30, 2021
2:46
#0daytoday #Pi-Hole Remove Commands Linux Privilege Escalation Exploit [remote #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Pi-Hole Remove Commands Linux Privilege Escalation Exploit [remote #exploits #0day #Exploit]
Tags:
2:46
#0daytoday #Panasonic Sanyo CCTV Network Camera 2.03-0x Cross Site Request Forgery Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Panasonic Sanyo CCTV Network Camera 2.03-0x Cross Site Request Forgery Vulnerability [#0day #Exploit]
Tags:
2:46
#0daytoday #ObjectPlanet Opinio 7.13 Shell Upload Vulnerability CVE-2020-26806 [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #ObjectPlanet Opinio 7.13 Shell Upload Vulnerability CVE-2020-26806 [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
2:46
#0daytoday #ObjectPlanet Opinio 7.13 Expression Language Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #ObjectPlanet Opinio 7.13 Expression Language Injection Vulnerability [#0day #Exploit]
Tags:
2:46
#0daytoday #ObjectPlanet Opinio 7.13 / 7.14 XML Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #ObjectPlanet Opinio 7.13 / 7.14 XML Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
July 29, 2021
6:44
#0daytoday #Oracle Fatwire 6.3 - Multiple Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Oracle Fatwire 6.3 - Multiple Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]
Tags:
6:44
#0daytoday #CloverDX 5.9.0 - Cross-Site Request Forgery to Remote Code Execution Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #CloverDX 5.9.0 - Cross-Site Request Forgery to Remote Code Execution Exploit [#0day #Exploit]
Tags:
6:44
#0daytoday #Care2x Integrated Hospital Info System 2.7 - (Multiple) SQL Injection Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Care2x Integrated Hospital Info System 2.7 - (Multiple) SQL Injection Vulnerability [#0day #Exploit]
Tags:
6:44
#0daytoday #IntelliChoice eFORCE Software Suite 2.5.9 - Username Enumeration Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #IntelliChoice eFORCE Software Suite 2.5.9 - Username Enumeration Vulnerability [#0day #Exploit]
Tags:
6:44
#0daytoday #Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Longjing Technology BEMS API 1.21 - Remote Arbitrary File Download Vulnerability [#0day #Exploit]
Tags:
6:41
#0daytoday #Denver IP Camera SHO-110 - Unauthenticated Snapshot Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Denver IP Camera SHO-110 - Unauthenticated Snapshot Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
July 28, 2021
9:56
#0daytoday #eGain Chat 15.5.5 Cross Site Scripting Vulnerability CVE-2020-15948 [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #eGain Chat 15.5.5 Cross Site Scripting Vulnerability CVE-2020-15948 [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
3:52
#0daytoday #TripSpark VEO Transportation - Blind SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #TripSpark VEO Transportation - Blind SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
3:52
#0daytoday #Denver Smart Wifi Camera SHC-150 - (Telnet) Remote Code Execution Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Denver Smart Wifi Camera SHC-150 - (Telnet) Remote Code Execution Vulnerability [#0day #Exploit]
Tags:
3:52
#0daytoday #Event Registration System with QR Code 1.0 - Authentication Bypass / Remote Code Execut [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Event Registration System with QR Code 1.0 - Authentication Bypass / Remote Code Execut [#0day #Exploit]
Tags:
July 27, 2021
13:45
#0daytoday #WordPress Social Warfare 3.5.2 Remote Code Execution Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress Social Warfare 3.5.2 Remote Code Execution Exploit [webapps #exploits #0day #Exploit]
Tags:
6:40
#0daytoday #Customer Relationship Management System (CRM) 1.0 Sql Injection Authentication Bypass V [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Customer Relationship Management System (CRM) 1.0 Sql Injection Authentication Bypass V [#0day #Exploit]
Tags:
6:40
#0daytoday #PHP 7.3.15-3 - (PHP_SESSION_UPLOAD_PROGRESS) Session Data Injection Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #PHP 7.3.15-3 - (PHP_SESSION_UPLOAD_PROGRESS) Session Data Injection Exploit [#0day #Exploit]
Tags:
July 26, 2021
10:50
#0daytoday #WordPress SP Project And Document Remote Code Execution Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress SP Project And Document Remote Code Execution Exploit [webapps #exploits #0day #Exploit]
Tags:
10:50
#0daytoday #WordPress Modern Events Calendar Remote Code Execution Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress Modern Events Calendar Remote Code Execution Exploit [webapps #exploits #0day #Exploit]
Tags:
10:50
#0daytoday #Zabbix 5.x SQL Injection / Cross Site Scripting Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Zabbix 5.x SQL Injection / Cross Site Scripting Vulnerabilities [webapps #exploits #Vulnerabilities #0day #Exploit]
Tags:
10:50
#0daytoday #XOS Shop 1.0.9 - (Multiple) Arbitrary File Deletion (Authenticated) Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #XOS Shop 1.0.9 - (Multiple) Arbitrary File Deletion (Authenticated) Vulnerability [#0day #Exploit]
Tags:
10:50
#0daytoday #NoteBurner 2.35 - Denial Of Service Exploit [dos #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #NoteBurner 2.35 - Denial Of Service Exploit [dos #exploits #0day #Exploit]
Tags:
10:50
#0daytoday #Leawo Prof. Media 11.0.0.1 - Denial of Service Exploit [dos #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Leawo Prof. Media 11.0.0.1 - Denial of Service Exploit [dos #exploits #0day #Exploit]
Tags:
10:50
#0daytoday #Elasticsearch ECE 7.13.3 - Anonymous Database Dump Exploit [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Elasticsearch ECE 7.13.3 - Anonymous Database Dump Exploit [webapps #exploits #0day #Exploit]
Tags:
July 23, 2021
13:32
#0daytoday #Microsoft SharePoint Server 2019 - Remote Code Execution Exploit (2) [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Microsoft SharePoint Server 2019 - Remote Code Execution Exploit (2) [#0day #Exploit]
Tags:
5:40
#0daytoday #WordPress Simple Post 1.1 Plugin - (Text field) Stored Cross-Site Scripting Vulnerabili [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress Simple Post 1.1 Plugin - (Text field) Stored Cross-Site Scripting Vulnerabili [#0day #Exploit]
Tags:
5:40
#0daytoday #ElasticSearch 7.13.3 - Memory disclosure Exploit CVE-2021-22145 [webapps #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #ElasticSearch 7.13.3 - Memory disclosure Exploit CVE-2021-22145 [webapps #exploits #0day #Exploit]
Tags:
July 22, 2021
3:46
#0daytoday #Microsoft Exchange Server Unpublished Pre-Authentication Remote Code Execution Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Microsoft Exchange Server Unpublished Pre-Authentication Remote Code Execution Exploit [#0day #Exploit]
Tags:
July 21, 2021
12:40
#0daytoday #WordPress Backup Guard Authenticated Remote Code Execution Exploit [remote #exploits #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #WordPress Backup Guard Authenticated Remote Code Execution Exploit [remote #exploits #0day #Exploit]
Tags:
12:40
#0daytoday #Sage X3 Administration Service Authentication Bypass / Command Execution Exploit [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Sage X3 Administration Service Authentication Bypass / Command Execution Exploit [#0day #Exploit]
Tags:
12:40
#0daytoday #Ampache 4.4.2 Cross Site Scripting Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Ampache 4.4.2 Cross Site Scripting Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
12:40
#0daytoday #News Portal Project 3.1 SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #News Portal Project 3.1 SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
12:40
#0daytoday #Online Shopping Portal 3.1 SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Online Shopping Portal 3.1 SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
12:40
#0daytoday #Vehicle Parking Management System 1.0 SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Vehicle Parking Management System 1.0 SQL Injection Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
12:40
#0daytoday #Vehicle Parking Management System 1.0 Cross Site Scripting Vulnerability [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #Vehicle Parking Management System 1.0 Cross Site Scripting Vulnerability [#0day #Exploit]
Tags:
2:38
#0daytoday #CSZ CMS 1.2.9 - (Multiple) Arbitrary File Deletion Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #CSZ CMS 1.2.9 - (Multiple) Arbitrary File Deletion Vulnerability [webapps #exploits #Vulnerability #0day #Exploit]
Tags:
2:13
#0daytoday #KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass Vulnerabilities [#0day #Exploit]
» ‎ 0day.today (was: 1337day, Inj3ct0r, 1337db)

#0daytoday #KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass Vulnerabilities [#0day #Exploit]
Tags:

May 25, 2021
8:06
FBI Analyst Indicted For Theft Of Osama bin Laden Threat Intel
» ‎ Packet Storm Security Headlines

FBI Analyst Indicted For Theft Of Osama bin Laden Threat Intel
Tags:
May 20, 2021
8:39
4 Vulnerabilities Under Attack Give Hackers Full Control Of Android Devices
» ‎ Packet Storm Security Headlines

4 Vulnerabilities Under Attack Give Hackers Full Control Of Android Devices
Tags:
May 13, 2021
7:25
Tesla Stops Accepting Bitcoin Due To Fossil Fuel Use
» ‎ Packet Storm Security Headlines

Tesla Stops Accepting Bitcoin Due To Fossil Fuel Use
Tags:
April 23, 2021
7:40
Malware Operators Use TLS 46% Of The Time When Detected
» ‎ Packet Storm Security Headlines

Malware Operators Use TLS 46% Of The Time When Detected
Tags:
7:40
Taiwan Authorities Look Into Apple Supplier Hack
» ‎ Packet Storm Security Headlines

Taiwan Authorities Look Into Apple Supplier Hack
Tags:
7:40
Ransomware Is Growing At An Alarming Rate, Warns GCHQ Chief
» ‎ Packet Storm Security Headlines

Ransomware Is Growing At An Alarming Rate, Warns GCHQ Chief
Tags:
7:40
MI5 Tries To Change Image By Opening Up Instagram Account
» ‎ Packet Storm Security Headlines

MI5 Tries To Change Image By Opening Up Instagram Account
Tags:
April 22, 2021
8:19
Signal CEO Hacks Cellebrite iPhone Hacking Device Used By Cops
» ‎ Packet Storm Security Headlines

Signal CEO Hacks Cellebrite iPhone Hacking Device Used By Cops
Tags:
8:19
Bugs Allowed Hackers To Dox All John Deere Owners
» ‎ Packet Storm Security Headlines

Bugs Allowed Hackers To Dox All John Deere Owners
Tags:
8:19
Telegram Platform Abused In ToxicEye Malware Campaigns
» ‎ Packet Storm Security Headlines

Telegram Platform Abused In ToxicEye Malware Campaigns
Tags:
8:19
SolarWinds Hack Analysis 56% Boost In Command Server Footprint
» ‎ Packet Storm Security Headlines

SolarWinds Hack Analysis 56% Boost In Command Server Footprint
Tags:
April 21, 2021
7:27
Zero-Day Vulns In SonicWall Email Security Are Being Exploited
» ‎ Packet Storm Security Headlines

Zero-Day Vulns In SonicWall Email Security Are Being Exploited
Tags:
7:27
Mozilla Fixes Firefox Flaw That Allowed Spoofing Of HTTPS Browser Padlock
» ‎ Packet Storm Security Headlines

Mozilla Fixes Firefox Flaw That Allowed Spoofing Of HTTPS Browser Padlock
Tags:
7:27
Campaign Targets Bloomberg Clients With RATs
» ‎ Packet Storm Security Headlines

Campaign Targets Bloomberg Clients With RATs
Tags:
7:27
Lessons Learned From SolarWinds And Exchange Hacks
» ‎ Packet Storm Security Headlines

Lessons Learned From SolarWinds And Exchange Hacks
Tags:
April 20, 2021
9:00
MI5 Warns Of Spies Using LinkedIn To Trick Staff Into Spilling Secrets
» ‎ Packet Storm Security Headlines

MI5 Warns Of Spies Using LinkedIn To Trick Staff Into Spilling Secrets
Tags:
9:00
Facebook Downplays Data Breach In Internal Email
» ‎ Packet Storm Security Headlines

Facebook Downplays Data Breach In Internal Email
Tags:
9:00
Lazarus Hacking Group Now Hides Payloads In BMP Image Files
» ‎ Packet Storm Security Headlines

Lazarus Hacking Group Now Hides Payloads In BMP Image Files
Tags:

December 21, 2019
0:00
Vuln: Yokogawa Vnet/IP Open Communication Driver CVE-2018-16196 Denial of Service Vulnerability
» ‎ SecurityFocus Vulnerabilities

Yokogawa Vnet/IP Open Communication Driver CVE-2018-16196 Denial of Service Vulnerability
Tags:

October 16, 2019
13:19
CVE-2019-5533 - VMware VeloCloud Authorization Bypass
» ‎ Bugtraq

Posted by Advisories on Oct 16
#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product: VeloCloud
# Vendor: VMware
# CVE ID: CVE-2019-5533
# CSNC ID: CSNC-2019-007
# Subject: Authorization Bypass
# Risk:...

Tags:

13:00
Painting with Light: The Homemade Pixelstick
» ‎ Hack a Day

Light painting has long graced the portfolios of long-exposure photographers, but high resolution isn’t usually possible when you’re light painting with human subjects.

This weekend project from [Timmo] uses an ESP8266-based microcontroller and an addressable WS2812-based LED strip to paint words or custom images in thin air. It’s actually based on the Pixelstick, a tool used by professional photographers for setting up animations and photorealism shots. The equipment needed for setting up the light painting sticks runs in the order of hundreds, not to mention the professional camera and lenses needed. Nevertheless, it’s a huge step up from waving around a flashlight with your friends.

The LED Lightpainter takes the Pixelstick a few notches lower for amateur photographers and hobbyists. It directly supports 24-bit BMP, with no conversion needed. Images are stored internally in Flash memory and are uploaded through a web interface. The settings for the number of LEDs, time for the image row, and STA/AP-mode for wireless connections are also set by the web interface. The project uses the Adafruit NeoPixel, ArduinoJson, and Bodmer’s TFT_HX8357 libraries for implementing the BMP drawing code, which also allows for an image preview prior to uploading the code to the microcontroller. Images are drawn from the bottom row to the top, so images have to be transformed before updating to the LED painter.

Some future improvements planned for the project include TFT/OLED support, rainbow or color gradient patterns in the LEDs, and accelerometer or gyroscope support for supporting animation.

There aren’t currently too many galleries of DIY LED-enabled light paintings, but we’d love to see some custom modded light painting approaches in the future.

This isn’t the first LED light stick we’ve seen, if you’re interested in such things.

Tags: arduino hacks
11:30
The Smallest Homebrewed TTL CPU In the World
» ‎ Hack a Day

The may very well be the smallest homemade TTL CPU we’ve ever seen. Measuring at one square inch, this tiny chip boasts 40 connections, an 8-bit databus, a 16-bit address bus, a 64 kB memory space, reset and clock inputs, and 5 V power lines.

TTL (transistor transistor logic) logic chips are pretty outdated today, but they do have all of the basics necessary for building a computer – logic gates, counters, buffers, and registers. The transistors perform both the logic and amplifying, as compared to resistor-transistor logic (RTL) and diode-transistor logic (DTL). In the 60s, when the technology was still fairly new, TTL ICs were commonly used in computers and industrial controls. Even after the advent of VLSI, TTL ICs were still being used for interfacing more densely integrated chips. Even so, most TTL chips tend to be on the bulkier side, which is what makes [roelh]’s project so unique. The entire PCB is hardly any larger than a coin.

On top of the hardware specs, [roelh] also implemented several useful software features: zero page addressing, load/store/compare instructions, stacks, conditioning branching, subroutine calls, and memory-mapped I/O. The registers are also in RAM, which has been implemented in microprocessors in the past (see TMS9900) for speed considerations, but in this case was implemented for size constraints.

An ALU was also left out of the design in order to constrain its size, leaving only 8 ICs on either side of the 2-layer PCB.

Microprograms are stored in Flash memory and can be programmed with a Raspberry Pi. by saving the Assembly code to a memory card and downloading the assembled binary code. Once the Raspberry Pi is connected to the development board, you can burn the binary code onto the Flash memory of the board using a Python script. An online Javascript editor also exists for assembling the Assembly code for the chip and simulating the CPU.

There is currently a development board made for the CPU, which includes six seven-segment displays and an I/O connector for running a digital clock and other applications. [roelh] has since built a retro TTL computer around the chip, which reintroduces the ALU and includes address registers, 256 KB of RAM, VGA video, PS/2 keyboard port, a sound system, and I/O pins. It’s a really exciting project that’s seriously pushing the constraints of retro computing.
The HackadayPrize2019 is Sponsored by:

Tags: Hardware
10:01
RTFM: ADCs and DACs
» ‎ Hack a Day

It’s tough to find a project these days that doesn’t use an analog-to-digital converter (ADC) or digital-to-analog converter (DAC) for something. Whether these converters come as built-in peripherals on a microcontroller, or as separate devices connected over SPI, I2C, or parallel buses, all these converters share some common attributes, and knowing how to read the specs on them can save you a lot of headaches when it comes to getting things working properly.

There are some key things to know about these devices, and the first time you try to navigate a datasheet on one, you may find yourself a bit confused. Let’s take a deep dive into the static (DC) properties of these converters — the AC performance is complex enough to warrant its own follow-up article.

The Two Domains
Think of digital pins on a microcontroller. The value of the pin can be a 1 or a 0 and it’s easy to understand that the voltage for those values will be zero volts or five volts (assuming our microcontroller is powered by a five volt source). What about all those voltages in between? If we need to measure or generate a signal anywhere in between the zero and five volt levels we’re going to need an ADC or DAC. But there are myriad different uses for the two.

The obvious purpose of these converters is to translate a quantity between analog and digital domains. Shown in the figure are two hypothetical 3-bit converters, one of each type. For simplicity, we’ll assume a straight binary encoding on the digital side, with ‘000’ corresponding to the smallest output and ‘111’ the largest. Other converters may use a signed or offset binary representation, or other more complex codes (PDF). Either way, the digital side, be it input or output, is pretty straightforward. In the case of an N-bit straight binary converter, the digital side consists of 2^N values, from 0 to 2^N-1. Note that 2^N itself is not in the set; our 3-bit converter stops at 7.

The analog side, on the other hand, can be more complex. For starters, the analog quantity can be a voltage, a current, or in the case of digital potentiometers, a resistance. In the case of voltage or current converters, the output may be single ended — that is, carried on a single wire — or differential, with the analog quantity being the difference between two inputs or outputs. But, underlying this diversity is a common set of properties — and specifications — that’s important for understanding and applying these converters.
Digital To Analog
For the simple 3-bit DAC described above, we can create an idealized plot of the transfer function — this is simply the relationship of input (a digital value) to output (an analog value). The digital value, on the x-axis, obviously takes on only certain values, indicated in binary on the plot. The y-axis is a little more confusing. It’s common in specifications to describe the analog side in units of LSB, corresponding to the smallest step of the converter — in other words, units of the analog value of the least significant bit. This at first seems like an odd way to describe an analog quantity, but there’s a good reason for it.

Almost all converters allow the designer to specify a reference value for the full-scale output. For instance, we might choose the full-scale output of a DAC to be 7 V in one circuit. In that case, the LSB would be 1 V. Also note that to get a 7 V full-scale output, we must use an 8 V reference voltage for the DAC: the maximum output is Vref * x / 2^N, where x is the binary input code. Note that your converter may vary: always read the datasheet to be sure.

In another circuit using this example DAC, we might choose a full-scale value of 3.5 V, so the LSB would be 0.5 V. So, the real-world resolution of the converter depends on the reference voltage. As it turns out, a number of other important parameters — especially errors — also depend on the reference, so listing them in LSB units in the datasheet allows an easy comparison and conversion to real-world units: a simple multiply does it.
Errors
One of the places you’ll see LSB units turning up is in non-linearity error specifications. Shown below is an excerpt from the datasheet for my go-to DAC for low-frequency use, the 12-bit voltage-output MCP4821 (PDF) from Microchip (they use LSb with a lower-case “b”, but I won’t hold it against them). Two other new terms also show up here — INL, or integral non-linearity, and DNL, or differential non-linearity. Even though they sound like you’ll have to dust off your old calculus textbook, don’t worry, these are both simple concepts.

DNL is simply the difference between an ideal LSB valued step size and what you’ll actually see from the device. In the case of the MCP4821, the ±0.25 LSB specification says that the actual step sizes will all be between 0.75 LSB and 1.25 LSB. In our 3-bit/7 V converter example, we can expect each step to be between 0.75 V and 1.25 V. (Footnote to the pedantic: the DNL specification is in the “typical” column of the datasheet, so you may actually see better or worse values). For large values of DNL, exceeding 1 LSB, the DAC can become non-monotonic, meaning that the output may decrease as the input increases in some interval; this is definitely something you need to be aware of.

INL, on the other hand, measures the maximum difference between an ideal straight-line transfer function and the actual one. For example, if the actual points lie along a curved or irregular path, the INL tells you how far off from the ideal value you can be at any point. For example, the ±4 LSB INL spec above would be terrible for our toy 3-bit / 7V converter, implying the output could be off by up to 4 V. For a 12-bit DAC, however, this is a much more respectable spec, implying less than 0.1% error (4 / 4095). Don’t make the mistake of taking ±4 LSB and interpreting this as four bits, or 2⁴ = 16 steps.
Analog to Digital
In the case of ADCs, the inputs and outputs take on reversed roles as shown in the plot of the transfer function for our toy 3-bit ADC. Now, the inputs are described in units of LSB, which may be voltage or current, and the output is a digital value, in this case a straight binary representation. As one would expect, the output code changes in jumps as the input value crosses successive thresholds. What may not be obvious at first is that the ideal thresholds are at half-steps, and the input range corresponding to the smallest and largest digital outputs are half the size of the others. The threshold between ‘000’ and ‘001’, for instance is set at 1/2 LSB. This minimizes the error in the conversion; you can think of this as “rounding” to the nearest output value.

Note that if we want our LSB value to be 1 V for this example ADC, we use an 8 V reference voltage. This sets the lowest threshold at 0.5 V, and the largest threshold at 6.5 V. This is a typical arrangement for ADCs, but this is not always the case; some converters have their thresholds at integer multiples of LSB. Always read the datasheet for your part to see exactly how it works.

DNL and INL errors are also specified for ADCs. In this case, the DNL error value specifies the maximum distance between thresholds for successive output values — in other words, the width of the steps in the graph. Again, values of DNL greater than 1 LSB can be problematic in ADCs, causing a symptom known as missing codes: the output may skip certain digital values entirely. As with DACs, in ADCs, INL error tells you the maximum distance of any threshold to the ideal straight line conversion, in other words, how far away from the expected value you can be.

There’s another “error” associated with ADCs: quantization error. I’ve thrown quotes around the word here because quantization error isn’t a deviation from the ideal ADC model. Instead, it’s simply a result of the discrete digital steps of the output. Since the input can have any analog value, there can be up to 1/2 LSB of error when this is converted to a digital value in discrete steps. For instance, an analog input value of 1/2 LSB plus an arbitrarily tiny amount will be converted as digital ‘001’, while an input of 1/2 LSB minus an arbitrarily tiny amount will be converted as ‘000’. Either one differs from the original input value by around 1/2 LSB.
Gain and Offset Error
The final two errors you’re likely to see mentioned are gain and offset. Offset error is easy to visualize: the zero point on either transfer function may not correspond to zero in the analog world; a voltage DAC with a digital input of zero may output a non-zero voltage. Gain errors, on the other hand, represent the difference from an ideal transfer slope of 1. For instance, if a voltage-output DAC has an integrated buffer amplifier, the amplifier may not have a gain of exactly 1; in this case, the buffer will cause the output to be high or low, depending on the actual amplifier gain. This is also where errors in a reference voltage show up.

The good thing about gain and offset errors is that they can be easily “calibrated out.” With two measurements of the system, you can determine the actual gain and offset values, and use these values to correct the errors in software. In fact, these are typically the only two errors that you’ll commonly see corrected; for the others, you’ll typically choose a better converter if you need it. TI has a nice video explaining how to do this calibration.
The Bottom Line
So, that’s a quick run-through of the DC (direct current) part of ADC and DAC specifications: the take away should be that you can understand the error in an ADC or DAC by examining the gain, offset, and INL specifications. Hopefully, this gives you enough as a starting point for digging in when you need to. If you want to delve into the details, there are a number of good references published by semiconductor manufacturers. TI’s Understanding Data Converters (PDF) is a great start; Microchip also has a good explanation on their site.

Tags: engineering
8:30
DIY Video Microscopy
» ‎ Hack a Day

Owning a Microscope is great fun as a hobby in general, but for hackers, it is a particularly useful instrument for assembly and inspection, now that we are building hardware with “grain of sand” sized components in our basements and garages. [voidnill] was given an Eduval 4 microscope by a well-meaning friend during a holiday trip. This model is pretty old, but it’s a Carl Zeiss after all, made in Jena in the erstwhile GDR. Since an optical microscope was of limited use for him, [voidnill] set about digitizing it.

He settled on the Raspberry-Pi route. The Pi and a hard disk were attached directly to the frame of the microscope, and a VGA display connected via a converter. Finally, the Pi camera was jury-rigged to one of the eyepieces using some foam. It’s a quick and dirty hack, and not the best solution, but it works well for [voidnill] since he wanted to keep the original microscope intact.

The standard Pi camera has a wide angle lens. It is designed to capture a large image and converge it on to the small sensor area. Converting it to macro mode is possible, but requires a hack. The lens is removed and ‘flipped over’, and fixed at a distance away from the sensor – usually with the help of an extension tube. This allows the lens to image a very small area and focus it on the (relatively) large sensor. This hack is used in the “OpenFlexure” microscope project, which you can read about in the post we wrote earlier this year or at this updated link. If you want even higher magnification and image quality, OpenFlexure provides a design to mate the camera sensor directly to an RMS threaded microscope objective. Since earlier this year, this open source microscope project has made a lot of progress, and many folks around the world have successfully built their own versions. It offers a lot of customisation options such as basic or high-resolution optics and manual or motorised stages, which makes it a great project to try out.

If the OpenFlexure project proves to be an intimidating build, you can try something easier. Head over to the PublicLab where [partsandcrafts] shows you how to “Build a Basic Microscope with Raspberry Pi”. It borrows from other open source projects but keeps things simpler making it much easier to build.

In the video embed below, [voidnill] gives a brief overview (in German) of his quick hack. If you’ve got some microscope hacks, or have built one of your own, let us know in the comments section.

Tags: Hardware

8:10
Adobe Acrobat Reader DC For Windows JP2 Stream Buffer Overflow
» ‎ Packet Storm Security Exploits

Adobe Acrobat Reader DC for Windows suffers from a heap-based buffer overflow vulnerability that can be leveraged via malformed JP2 streams.
Tags:

8:10
Adobe Acrobat Reader DC For Windows JP2 Stream Buffer Overflow
» ‎ Packet Storm Security Recent Files

Adobe Acrobat Reader DC for Windows suffers from a heap-based buffer overflow vulnerability that can be leveraged via malformed JP2 streams.
Tags:

8:10
Adobe Acrobat Reader DC For Windows JP2 Stream Buffer Overflow
» ‎ Packet Storm Security Misc. Files

Adobe Acrobat Reader DC for Windows suffers from a heap-based buffer overflow vulnerability that can be leveraged via malformed JP2 streams.
Tags:

8:09
Debian Security Advisory 4544-1
» ‎ Packet Storm Security Advisories

Debian Linux Security Advisory 4544-1 - X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries. This could lead to remote denial-of-service by application crash.
Tags:

8:09
Debian Security Advisory 4544-1
» ‎ Packet Storm Security Recent Files

Debian Linux Security Advisory 4544-1 - X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries. This could lead to remote denial-of-service by application crash.
Tags:

8:09
Debian Security Advisory 4544-1
» ‎ Packet Storm Security Misc. Files

Debian Linux Security Advisory 4544-1 - X41 D-Sec discovered that unbound, a validating, recursive, and caching DNS resolver, did not correctly process some NOTIFY queries. This could lead to remote denial-of-service by application crash.
Tags:

8:09
Red Hat Security Advisory 2019-3128-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3128-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include deserialization and null pointer vulnerabilities.
Tags:

8:09
Red Hat Security Advisory 2019-3128-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3128-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include deserialization and null pointer vulnerabilities.
Tags:

8:09
Red Hat Security Advisory 2019-3128-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3128-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include deserialization and null pointer vulnerabilities.
Tags:

8:09
Accounts Accounting 7.02 Cross Site Scripting
» ‎ Packet Storm Security Exploits

Accounts Accounting version 7.02 suffers from a persistent cross site scripting vulnerability.
Tags:

8:09
Accounts Accounting 7.02 Cross Site Scripting
» ‎ Packet Storm Security Recent Files

Accounts Accounting version 7.02 suffers from a persistent cross site scripting vulnerability.
Tags:

8:09
Accounts Accounting 7.02 Cross Site Scripting
» ‎ Packet Storm Security Misc. Files

Accounts Accounting version 7.02 suffers from a persistent cross site scripting vulnerability.
Tags:

8:06
Red Hat Security Advisory 2019-3089-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3089-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

8:06
Red Hat Security Advisory 2019-3089-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3089-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

8:06
Red Hat Security Advisory 2019-3089-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3089-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

8:05
LiteManager 4.5.0 romservice Unquoted Service Path
» ‎ Packet Storm Security Exploits

LiteManager version 4.5.0 suffers from a romservice unquoted service path vulnerability.
Tags:

8:05
LiteManager 4.5.0 romservice Unquoted Service Path
» ‎ Packet Storm Security Recent Files

LiteManager version 4.5.0 suffers from a romservice unquoted service path vulnerability.
Tags:

8:05
LiteManager 4.5.0 romservice Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

LiteManager version 4.5.0 suffers from a romservice unquoted service path vulnerability.
Tags:

8:04
Debian Security Advisory 4509-3
» ‎ Packet Storm Security Advisories

Debian Linux Security Advisory 4509-3 - It was reported that the apache2 update released as DSA 4509-1 incorrectly fixed CVE-2019-10092. Updated apache2 packages are now available to correct this issue.
Tags:

8:04
Debian Security Advisory 4509-3
» ‎ Packet Storm Security Recent Files

Debian Linux Security Advisory 4509-3 - It was reported that the apache2 update released as DSA 4509-1 incorrectly fixed CVE-2019-10092. Updated apache2 packages are now available to correct this issue.
Tags:

8:04
Debian Security Advisory 4509-3
» ‎ Packet Storm Security Misc. Files

Debian Linux Security Advisory 4509-3 - It was reported that the apache2 update released as DSA 4509-1 incorrectly fixed CVE-2019-10092. Updated apache2 packages are now available to correct this issue.
Tags:

8:03
Solaris 11.4 xscreensaver Privilege Escalation
» ‎ Packet Storm Security Exploits

Solaris version 11.4 xscreensaver local privilege escalation exploit.
Tags:

8:03
Solaris 11.4 xscreensaver Privilege Escalation
» ‎ Packet Storm Security Recent Files

Solaris version 11.4 xscreensaver local privilege escalation exploit.
Tags:

8:03
Solaris 11.4 xscreensaver Privilege Escalation
» ‎ Packet Storm Security Misc. Files

Solaris version 11.4 xscreensaver local privilege escalation exploit.
Tags:

8:00
WordPress Broken Link Checker 1.11.8 Cross Site Scripting
» ‎ Packet Storm Security Exploits

WordPress Broken Link Check plugin version 1.11.8 suffers from a cross site scripting vulnerability.
Tags:

8:00
WordPress Broken Link Checker 1.11.8 Cross Site Scripting
» ‎ Packet Storm Security Recent Files

WordPress Broken Link Check plugin version 1.11.8 suffers from a cross site scripting vulnerability.
Tags:

8:00
WordPress Broken Link Checker 1.11.8 Cross Site Scripting
» ‎ Packet Storm Security Misc. Files

WordPress Broken Link Check plugin version 1.11.8 suffers from a cross site scripting vulnerability.
Tags:

7:59
Mikogo 5.2.2.150317 Mikogo-Service Unquoted Service Path
» ‎ Packet Storm Security Exploits

Mikogo version 5.2.2.150317 suffers from a Mikogo-Service unquoted service path vulnerability.
Tags:

7:59
Mikogo 5.2.2.150317 Mikogo-Service Unquoted Service Path
» ‎ Packet Storm Security Recent Files

Mikogo version 5.2.2.150317 suffers from a Mikogo-Service unquoted service path vulnerability.
Tags:

7:59
Mikogo 5.2.2.150317 Mikogo-Service Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

Mikogo version 5.2.2.150317 suffers from a Mikogo-Service unquoted service path vulnerability.
Tags:

7:57
Tomedo Server 1.7.3 Information Disclosure / Weak Cryptography
» ‎ Packet Storm Security Exploits

Tomedo Server version 1.7.3 suffers from using weak cryptography for passwords and cleartext transmission of sensitive information vulnerabilities.
Tags:

7:57
Tomedo Server 1.7.3 Information Disclosure / Weak Cryptography
» ‎ Packet Storm Security Recent Files

Tomedo Server version 1.7.3 suffers from using weak cryptography for passwords and cleartext transmission of sensitive information vulnerabilities.
Tags:

7:57
Tomedo Server 1.7.3 Information Disclosure / Weak Cryptography
» ‎ Packet Storm Security Misc. Files

Tomedo Server version 1.7.3 suffers from using weak cryptography for passwords and cleartext transmission of sensitive information vulnerabilities.
Tags:

7:54
CyberArk Password Vault 10.6 Authentication Bypass
» ‎ Packet Storm Security Exploits

CyberArk Password Vault version 10.6 suffers from an authentication bypass vulnerability.
Tags:

7:54
CyberArk Password Vault 10.6 Authentication Bypass
» ‎ Packet Storm Security Recent Files

CyberArk Password Vault version 10.6 suffers from an authentication bypass vulnerability.
Tags:

7:54
CyberArk Password Vault 10.6 Authentication Bypass
» ‎ Packet Storm Security Misc. Files

CyberArk Password Vault version 10.6 suffers from an authentication bypass vulnerability.
Tags:

7:53
Linux/x86 Add User To /etc/passwd Shellcode
» ‎ Packet Storm Security Recent Files

74 bytes small add user User to /etc/passwd shellcode.
Tags:

7:53
Linux/x86 Add User To /etc/passwd Shellcode
» ‎ Packet Storm Security Misc. Files

74 bytes small add user User to /etc/passwd shellcode.
Tags:

7:52
Linux/x86 execve /bin/sh Shellcode
» ‎ Packet Storm Security Recent Files

25 bytes small Linux/x86 execve /bin/sh shellcode.
Tags:

7:52
Linux/x86 execve /bin/sh Shellcode
» ‎ Packet Storm Security Misc. Files

25 bytes small Linux/x86 execve /bin/sh shellcode.
Tags:

7:50
Linux/x86 Reverse Shell NULL Free 127.0.0.1:4444 Shellcode
» ‎ Packet Storm Security Recent Files

91 bytes small Linux/x86 reverse shell NULL free 127.0.0.1:4444 shellcode.
Tags:

7:50
Linux/x86 Reverse Shell NULL Free 127.0.0.1:4444 Shellcode
» ‎ Packet Storm Security Misc. Files

91 bytes small Linux/x86 reverse shell NULL free 127.0.0.1:4444 shellcode.
Tags:

7:49
X.Org X Server 1.20.4 Local Stack Overflow
» ‎ Packet Storm Security Exploits

X.Org X Server version 1.20.4 suffers from a local stack overflow vulnerability.
Tags:

7:49
X.Org X Server 1.20.4 Local Stack Overflow
» ‎ Packet Storm Security Recent Files

X.Org X Server version 1.20.4 suffers from a local stack overflow vulnerability.
Tags:

7:49
X.Org X Server 1.20.4 Local Stack Overflow
» ‎ Packet Storm Security Misc. Files

X.Org X Server version 1.20.4 suffers from a local stack overflow vulnerability.
Tags:

7:47
Whatsapp 2.19.216 Remote Code Execution
» ‎ Packet Storm Security Exploits

Whatsapp version 2.19.216 suffers from a remote code execution vulnerability.
Tags:

7:47
Whatsapp 2.19.216 Remote Code Execution
» ‎ Packet Storm Security Recent Files

Whatsapp version 2.19.216 suffers from a remote code execution vulnerability.
Tags:

7:47
Whatsapp 2.19.216 Remote Code Execution
» ‎ Packet Storm Security Misc. Files

Whatsapp version 2.19.216 suffers from a remote code execution vulnerability.
Tags:

7:46
Lavasoft 2.3.4.7 LavasoftTcpService Unquoted Service Path
» ‎ Packet Storm Security Exploits

Lavasoft version 2.3.4.7 suffers from a LavasoftTcpService unquoted service path vulnerability.
Tags:

7:46
Lavasoft 2.3.4.7 LavasoftTcpService Unquoted Service Path
» ‎ Packet Storm Security Recent Files

Lavasoft version 2.3.4.7 suffers from a LavasoftTcpService unquoted service path vulnerability.
Tags:

7:46
Lavasoft 2.3.4.7 LavasoftTcpService Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

Lavasoft version 2.3.4.7 suffers from a LavasoftTcpService unquoted service path vulnerability.
Tags:

7:45
Sextortion Botnet Spreads 30,000 Emails An Hour
» ‎ Packet Storm Security Headlines

Sextortion Botnet Spreads 30,000 Emails An Hour
Tags: headlineemailcybercrimebotnetfraud
7:44
US Claims Cyber Strike On Iran After Attack On Saudi Oil Facility
» ‎ Packet Storm Security Headlines

US Claims Cyber Strike On Iran After Attack On Saudi Oil Facility
Tags: headlinegovernmentusacyberwariransaudi arabia
7:44
Fraud Bazaar Selling Stolen Payment Cards Heisted For 26 Million Cards
» ‎ Packet Storm Security Headlines

Fraud Bazaar Selling Stolen Payment Cards Heisted For 26 Million Cards
Tags: headlinehackerbankcybercrimedata lossfraud
7:44
Pentagon Hack The Proxy Program Uncovers 31 Vulnerabilities
» ‎ Packet Storm Security Headlines

Pentagon Hack The Proxy Program Uncovers 31 Vulnerabilities
Tags: headlinehackergovernmentusaflawcyberwarmilitary

7:18
[SECURITY] [DSA 4509-3] apache2 security update
» ‎ Bugtraq

Posted by Salvatore Bonaccorso on Oct 16
-------------------------------------------------------------------------
Debian Security Advisory DSA-4509-3 security () debian org
https://www.debian.org/security/ Salvatore Bonaccorso
October 15, 2019 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : apache2
CVE ID : CVE-2019-10092
Debian Bug :...

Tags:
7:14
[SECURITY] [DSA 4544-1] unbound security update
» ‎ Bugtraq

Posted by Sebastien Delafond on Oct 16
-------------------------------------------------------------------------
Debian Security Advisory DSA-4544-1 security () debian org
https://www.debian.org/security/ Sebastien Delafond
October 16, 2019 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : unbound
CVE ID : CVE-2019-16866
Debian Bug :...

Tags:
7:11
CVE-2019-3010 - Local privilege escalation on Solaris 11.x via xscreensaver
» ‎ Bugtraq

Posted by Marco Ivaldi on Oct 16
Dear Bugtraq,

Please find attached an advisory for the following vulnerability, fixed in Oracle's Critical Patch Update (CPU) of
October 2019:

"Exploitation of a design error vulnerability in xscreensaver, as distributed with Solaris 11.x, allows local attackers
to create (or append to) arbitrary files on the system, by abusing the -log command line switch introduced in version
5.06. This flaw can be leveraged to cause a denial of...

Tags:

7:00
Pack Your Bags – Systemd Is Taking You To A New Home
» ‎ Hack a Day

Home directories have been a fundamental part on any Unixy system since day one. They’re such a basic element, we usually don’t give them much thought. And why would we? From a low level point of view, whatever location $HOME is pointing to, is a directory just like any other of the countless ones you will find on the system — apart from maybe being located on its own disk partition. Home directories are so unspectacular in their nature, it wouldn’t usually cross anyone’s mind to even consider to change anything about them. And then there’s Lennart Poettering.

In case you’re not familiar with the name, he is the main developer behind the systemd init system, which has nowadays been adopted by the majority of Linux distributions as replacement for its oldschool, Unix-style init-system predecessors, essentially changing everything we knew about the system boot process. Not only did this change personally insult every single Perl-loving, Ken-Thompson-action-figure-owning grey beard, it engendered contempt towards systemd and Lennart himself that approaches Nickelback level. At this point, it probably doesn’t matter anymore what he does next, haters gonna hate. So who better than him to disrupt everything we know about home directories? Where you _live_?

Although, home directories are just one part of the equation that his latest creation — the systemd-homed project — is going to ~~make people hate him even more~~ tackle. The big picture is really more about the whole concept of user management as we know it, which sounds bold and scary, but which in its current state is also a lot more flawed than we might realize. So let’s have a look at what it’s all about, the motivation behind homed, the problems it’s going to both solve and raise, and how it’s maybe time to leave some outdated philosophies behind us.

A Quick Introduction To Systemd
Just one more module… Image: Shmuel Csaba Otto Traian [CC BY-SA 3.0], via Wikimedia CommonsBefore we get into the homed part of the endeavor, let’s bring everyone on the same page about systemd itself. In simple words, systemd handles everything that lies beyond the kernel’s tasks to start up the system: setting up the user space and providing everything required to get all system processes and daemons running, and managing those processes along the way. It’s both replacing the old init process running with PID 1, and providing an administrative layer between the kernel and user space, and as such, is coming with a whole suite of additional tools and components to achieve all that: system logger, login handling, network management, IPC for communication between each part, and so on. So, what was once handled by all sorts of single-purpose tools has since become part of systemd itself, which is one source of resentment from people latching on to the “one tool, one job” philosophy.

Technically, each tool and component in systemd is still shipped as its own executable, but due to interdependency of these components they’re not really that standalone, and it’s really more just a logical separation. systemd-homed is therefore one additional such component, aimed to handle the user management and the home directories of those users, tightly integrated into the systemd infrastructure and all the additional services it provides.

But why change it at all? Well, let’s have a look at the current way users and home directories are handled in Linux, and how systemd-homed is planning to change that.
The Status Quo Of $HOME And User Management
Since the beginning of time, users have been stored in the /etc/passwd file, which includes among other things the username, a system-unique user id, and the home directory location. Traditionally, the user’s password was also stored in hashed form in that file — and it might still be the case on some, for example embedded systems — but was eventually moved to a separate /etc/shadow file, with more restricted file permissions. So, after successfully logging in to the system with the password found in the shadow file, the user starts off in whichever location the home directory entry in /etc/passwd is pointing to.
Sure you want to live here? “Rosedale home”by Sheba_Also, CC BY-SA 2.0
In other words, for the most fundamental process of logging in to a system, three individual parts that are completely independent and separated from each other are required. Thanks to well-defined rules that stem from simpler times and have since remained mostly untouched, and which every system and tool involved in the process commendably abides by, this has worked out just fine. But if we think about it: is this really the best possible approach?

Note that this is just the most basic local user login. Throw in some network authentication, additional user-based resource management, or disk encryption, and you will notice that /etc/passwd isn’t the place for any of that. And well, why would it be — one tool, one job, right? As a result, instead of configuring everything possibly related to a user in one centralized user management system that is flexible enough for any present and future considerations, we just stack dozens of random configurations on top of and next to each other, with each one of them doing their own little thing. And we are somehow perfectly fine and content with that.

Yet, if you had to design a similar system today from scratch, would you really opt for the same concept? Would your system architect, your teacher, or even you yourself really be fine with duplicate database entries (usernames both in passwd and shadow file), unenforced relationships (home directory entry and home directory itself), and just random additional data without rhyme or reason: resource management, PAM, network authentication, and so on? Well, as you may have guessed by now, Lennart Poettering isn’t much a fan of that, and with systemd-homed he is aiming to unite all the separate configuration entities around user management into one centralized system, flexible enough to handle everything the future might require.
Knock Knock – It’s Systemd
So instead of each component having its own configuration for all users, systemd-homed is going to collect all the configuration data of each component based on the user itself, and store it in a user-specific record in form of a JSON file. The file will include all the obvious information such as username, group membership, and password hashes, but also any user-dependent system configurations and resource management information, and essentially really just anything relevant. Being JSON, it can virtually contain whatever you want to put there, meaning it is easily extendable whenever new features and capabilities are required. No need to wonder anymore which of those three dozen files you need to touch if you want to change something.

In addition to user and user-based system management, the home directory itself will be linked to it as a LUKS encrypted container — and this is where the interesting part comes, even if you don’t see a need for a unified configuration place: the encryption is directly coupled to the user login itself, meaning not only is the disk automatically decrypted once the user logs in, it is equally automatic encrypted again as soon as the user logs out, locks the screen, or suspends the device. In other words, your data is inaccessible and secure whenever you’re not logged in, while the operating system can continue to operate independently from that.

There is, of course, one downside to that.
Chicken / Egg Problem With SSH
If the home directory requires an actively logged-in user to decrypt the home directory, there’s going to be a problem with remote logins via SSH that depend on the SSH decryption key found inside the (at that point encrypted) home directory. For that reason, SSH simply won’t work without a logged in local user, which of course defies the whole point of remote access.
The OpenSSH logo.
That being said, it’s worth noting that at this stage, systemd-homed is focusing mostly on regular, real human users on a desktop or laptop, and not so much system or service-specific users, or anything running remotely on a server. That sounds of course like a bad excuse, but keep also in mind that systemd-homed will change the very core of user handling, so it’s probably safe to assume that future iterations will diminish that separation and things will work properly for either type of user. I mean, no point to reinvent the wheel if you need to keep the old one around as well — but feel free to call me naive here.

Ideally, the SSH keys would be migrated to the common-place user management record, but that would require some work on SSH’s side. This isn’t happening right now, but then again, systemd-homed itself is also just a semi-implemented idea in a git branch at this point. It’s unlikely going to be widely adapted and forced onto you by the evil Linux distributions until this issue in particular is solved — but again, maybe I’m just overly optimistically naive.
Self-Contained Users With Portable Homes
But with user management and home directory handling in a single place and coupled together, you can start to dream of additional possible features. For instance, portable home directories that double as self-contained users. What that means is that you could keep the home directory for example on a USB stick or external disk, and seamlessly move it between, say, your workstation at home and your laptop whenever you’re on the move. No need to duplicate or otherwise sync your data, it’s all in one place with you. This brings security and portability benefits.
Or would you rather live here? By ltenney1225 CC BY-NC 2.0
But that’s not all. It wouldn’t have to be your own device you can attach your home directory to, it could be a friend’s device or the presenter laptop at a conference or really any compatible device. As soon as you plug in your home directory into it, your whole user will automatically exist on that device as well. Well, sort of automatically. Obviously, no one would want some random people roaming around on their system, so the system owner / superuser will still have to grant you access to their system first, with a user and resource configuration based on their own terms, and signed to avoid tempering.

Admittedly, for some of you, this might all sound less like amazing new features and more like a security nightmare and mayhem just waiting to happen. And it most certainly will bring a massive change to yet another core element of Linux where a lot could possibly go wrong. How it will all play out in reality remains to be seen. Clearly it won’t happen over night, and it won’t happen out of nowhere either — the changes are just too deep and fundamental. But being part of systemd itself, and seeing its influence on Linux, one has to entertain the idea that this might happen one day in the not too distant future. And maybe it should.
Times Are Changing
Yes, this will disrupt everything we know about user management. And yes, it goes against everything Unix stands for. But it also gets rid of an ancient concept that goes against everything the software engineering world has painfully learned as best practices over all these decades since. After all, it’s neither the 70s nor the 80s anymore. We don’t have wildly heterogeneous environments anymore where we need to find the least capable common denominator for each and every system anymore. Linux is the dominant, and arguably the only really relevant open source “Unix” system nowadays — even Netflix and WhatsApp running FreeBSD is really more anecdotal in comparison. So why should Linux really care about compatibility with “niche” operating systems that are in the end anyway going to do their own thing? And for that matter, why should we still care about Unix altogether?

It generally begs the question, why do we keep on insisting that computer science as a discipline has reached its philosophical peak in a time the majority of its current practitioners weren’t even born yet? Why are we so frantically holding on to a philosophy that was established decades before the world of today with its ubiquitous internet, mobile connectivity, cloud computing, Infrastructure/Platform/Software/Whatnot-as-a-Service, and everything on top and below that has become reality? Are we really that nostalgic about the dark ages?

I’m not saying that the complexity we have reached with technology is necessarily an outcome we should have all hoped for, but it is where we are today. And it’s only going to get worse. The sooner we accept that and move on from here, and maybe adjust our ancient philosophies along the way, the higher the chance that we will actually manage to tame this development and keep control over it.

Yes, change is a horrible, scary, and awful thing if it’s brought upon us by anyone else but ourselves. But it’s also inevitable, and systemd-homed might just be the proverbial broken egg that will give us a delicious omelette here. Time will tell.

Tags: featured
4:00
A Tamagotchi for WiFi Cracking
» ‎ Hack a Day

OK, let’s start this one by saying that it’s useful to know how to break security measures in order to understand how to better defend yourself, and that you shouldn’t break into any network you don’t have access to. That being said, if you want to learn about security and the weaknesses within the WPA standard, there’s no better way to do it than with a tool that mimics the behavior of a Tamagotchi.

Called the pwnagotchi, this package of artificial intelligence looks for information in local WiFi packets that can be used to crack WPA encryption. It’s able to modify itself in order to maximize the amount of useful information it’s able to obtain from whatever environment you happen to place it in. As an interesting design choice, the pwnagotchi behaves like an old Tamagotchi pet would, acting happy when it gets the inputs it needs.

This project is beyond a novelty though and goes deep in the weeds of network security. If you’re at all interested in the ways in which your own networks might be at risk, this might be a tool you can use to learn a little more about the ways of encryption, general security, and AI to boot. Of course, if you’re new to the network security world, make sure the networks you’re using are secured at least a little bit first.

Thanks to [Itay] for the tip!

Tags: security hacks

3:33
Zilab Remote Console Server 3.2.9 zrcs Unquoted Service Path
» ‎ Packet Storm Security Exploits

Zilab Remote Console Server version 3.2.9 suffers from a zrcs unquoted service path vulnerability.
Tags:

3:33
Zilab Remote Console Server 3.2.9 zrcs Unquoted Service Path
» ‎ Packet Storm Security Recent Files

Zilab Remote Console Server version 3.2.9 suffers from a zrcs unquoted service path vulnerability.
Tags:

3:33
Zilab Remote Console Server 3.2.9 zrcs Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

Zilab Remote Console Server version 3.2.9 suffers from a zrcs unquoted service path vulnerability.
Tags:

1:00
Cordless Drill Sprouts Wings And Takes Flight
» ‎ Hack a Day

Brushless motors and lithium batteries were a revolution for remote control aircraft. No longer would nitro engines rule the roost, as flying became far cheaper and more accessible almost overnight. The same technology has also found its way into power tools, leading to [Peter Sripol] deciding to build a powerdrill into a flying aircraft in this video, embedded below.

An unmodified DeWalt drill is the heart of the build, serving as the propulsion unit of the craft. A servo is used to actuate the drill’s trigger to serve as the throttle. As power drills are geared down significantly compared to a typical hobby brushless motor, it was necessary to use a much larger prop than would be usual. This was custom machined out of wood with the help of [William Osman], and despite some mishaps, came out (mostly) in one piece. The airframe consists of foam wings with poplar spars, and an aluminium extrusion serves as the tail boom. A few 3D printed parts then tie everything together.

Despite the weight of the drill, the hacked-together craft is able to fly quite easily. The large wings and propeller help to make up for the shortcomings of the powertrain. Unfortunately, there wasn’t quite enough surplus lift to carry a payload of smartphones to capture in-flight footage, but overall the project could be considered a resounding success.

We’ve seen [Peter]’s work before, too – sometimes even putting himself in the pilots seat! Video after the break.

Tags: tool hacks

October 15, 2019
22:59
reinersct: receiving annual awards for trivial insecurity
» ‎ Full Disclosure

Posted by Thegirl Wholearnedtocode on Oct 15
https://www.reiner-sct.com/lang/en/search.html?m=all&q="><marquee>&dosubmit=submit

I have to unfortunately use their products via another "security" vendor.
If anyone knows them, feel free to reach out and help them.

Tags:
22:58
Tomedo Server - Weak encryption mech.
» ‎ Full Disclosure

Posted by ProSec Security Team on Oct 15
Hello together,

we’ve found the following vulnerability below.

Affected software: Tomedo Server 1.7.3
Vulnerability type: Cleartext Transmission of Sensitive Information & Weak Cryptography for Passwords
Vulnerable version: Tomedo Server 1.7.3
Vulnerable component: Customer Tomedo Server that communicates with Vendor Tomedo Update Server
Vendor report confidence: Confirmed
Fixed version: Version later then 1.7.3
Vendor notification:...

Tags:
22:57
APPLE-SA-2019-10-11-1 Swift 5.1.1 for Ubuntu
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Oct 15
APPLE-SA-2019-10-11-1 Swift 5.1.1 for Ubuntu

Swift 5.1.1 for Ubuntu is now available and addresses the following:

Foundation
Available for: Ubuntu 14.04, 16.04 and 18.04
Impact: Incorrect management of file descriptors in URLSession could
lead to inadvertent data disclosure
Description: This issue was addresses by updating incorrect
URLSession file descriptors management logic to match Swift 5.0.
CVE-2019-8790: Apple

Installation note:

Swift...

Tags:
22:57
Reflected XSS via Broken Link Checker v.1.11.8 WordPress Plugin
» ‎ Full Disclosure

Posted by Ismail Doe on Oct 15
Document Title
===============
Reflected XSS via `Broken Link Checker` v.1.11.8 WordPress plugin.

Product Description
===============
Broken Link Checker will monitor your blog looking for broken links and let
you know if any are found.

Homepage: https://managewp.com/
WordPress Plugin: https://wordpress.org/plugins/broken-link-checker/

PoC
===============

1) Login to your wordpress webpage
2) Navigate to the following page (Make sure the...

Tags:
22:56
[CFP] BSides San Francisco – February 2020
» ‎ Full Disclosure

Posted by BSidesSF CFP via Fulldisclosure on Oct 15
BSidesSF is soliciting presentations and workshops for the 2020 annual
BSidesSF conference.

CFP: https://bsidessf.org/cfp.html

** Topics **

All topic areas related to reliability, network security, privacy,
cryptography, and information security are of interest and in scope.

Let us help you get the word out on The Next Big Thing!

** Theme **

San Francisco, to celebrate BSidesSF's 10th anniversary

** Submission **...

Tags:

22:00
Recreating Lord Nikon’s Laptop From Hackers
» ‎ Hack a Day

The outlandish computers from 1995’s Hackers are easily one of the most memorable elements of the iconic cult classic. In the film, each machine is customized to reflect the individual hacker that operates it, and feature everything from spray painted camouflage paint schemes to themed boot animations based on the owner’s personal iconography. But what might not so obvious is that the real-life props took a considerable amount of hardware hacking before they were ready for their big-screen debut.

A group of dedicated Hackers fans have created a website to document, and ideally recreate, all the custom work that went into the various pieces of tech featured in the film. As explained by [Nandemoguy], the group’s latest triumph is a screen-accurate build of Lord Nikon’s laptop. The final product not only looks just like the machine used in the film, but thanks to the internal Raspberry Pi, is far more powerful than the original computer would have been.

Unless you’re on the team over at HackersCurator.com, you might not know that the laptops in the film were handmade chimeras that combined the external cases of various PCs with (usually) the internals of an Apple Powerbook 180c. Why the prop masters of the film would have gone through so much trouble to create the character’s computers is not immediately clear, but if we had to guess, presumably it was due to the requirements of the over-the-top graphical interfaces that are featured so heavily in the film.

At any rate, the replica created by [Nandemoguy] is built in much the same way. At least for the parts you can see on the outside, anyway. He goes through the considerable case modifications required to replace the original keyboard on the Toshiba Satellite T1850 with a Powerbook keyboard, which as you might have guessed, has been converted into a USB HID device with a Teensy microcontroller. He even cuts the ports off the back of the Mac’s motherboard and glues them in place around the backside of the machine. But everything else, including the LCD, is all new hardware. After all, who really wants to go through all that trouble just to have a fancy Powerbook 180c in 2019?

Even if you weren’t a fan of Hackers, the level of detail and effort put into this build it absolutely phenomenal. It’s interesting to see the parallels between this replica and the burgeoning cyberdeck scene; it seems like with a Teensy, a Raspberry Pi, and enough Bondo, anything can be turned into a functional computer.

Tags: laptops hacks
19:00
Endless Electronic Problems For Solving
» ‎ Hack a Day

We know not everyone who likes to build circuitry wants to dive headfirst into the underlying electrical engineering that makes everything work. However, if you want to, now is a great time. Many universities have most or all of their material online and you can even take many courses for free. If you want an endless pool of solved study problems, check out autoCircuits. It can create many different kinds of electronics problems and their solutions.

You can get a totally random circuit, or choose if you want to focus on DC, AC, two-ports, or several other types of problems. You can also alter the general form of the problem. For example, for a DC analysis, you can have it assign circuit values so that the answer is a value such as 45 ohms, or you can have it just use symbols so that the answer might be i4=V1/4R. You even get to pick the difficulty level and pick certain types of problems to avoid. Just be fast. After the site generates a problem, you have 10 seconds to download it before it is gone forever.

The problems range from simple to complex so for example our first screenshot is an easy one.

The program provides the solution, but this one is pretty easy — you just have to combine the parallel and series resistances. With symbolic resistances, the values might have been things like R, 3R, and 9R. Or you can pick to have non-integers like 0.23R or even rational numbers like 22/5 as the multiplying factor.

The program has one other cool feature: you can input a SPICE netlist to plug in your own circuits. There are some restrictions. For example, you can only have 10 nodes and there are some strict naming conventions. In addition, all component values will be selected randomly.

For an example of the SPICE function, try this netlist:

V_1 1 0 AC
C_1 1 2
C_2 1 2
R_1 2 0
.TRAN Solve V(2,0)

The output looks like the screenshot to the right, although yours will almost certainly have different random values:

If like us, you were too lazy to work it out, the output also shows the answer: v4(t)=(-4.111 cos(9.4t)-4.092 sin(9.4t)). Yeah. That’s what we were thinking.

This would be great if you were teaching electronics, too. You could generate an endless amount of homework or quiz questions. [Stephano] offers the service for free and uses software ranging from MATLAB, BLAG, and LaTeX to do its magic.

If you want to brush up on Spice and using it for analysis, we’ve been there. By the way, the first analysis tool you generally learn is nodal analysis and that would be a good first step to solving these kinds of problems.

Tags: misc hacks
16:00
Solar Powered Weeding Tractor Uses Manual Labour
» ‎ Hack a Day

You might not have realised this, but there’s a group of hackers out there without whom you wouldn’t be able to put food on the table. They hack under the blazing sun and pouring rain, and have been doing it for thousands of years. Known more commonly as farmers, their creative problem solving skills with whatever is lying around can be absolutely jaw dropping. [Andrew Mans] is one such individual. He built a solar powered weeding tractor that uses human labour to do the actual weeding.

We’ll be honest, this made us go “Wait, what?” for a few seconds, until the ingenuity of it all sank in. Crawling at a snails pace across the onion fields at Mans Organics, the contraption allows 3 workers to lie comfortably on their stomachs in a shaded tent, while pulling weeds that grow too close to the crop for conventional mechanised weeding methods. While this might seem like a slightly crappy job at first glance, there are definitely worse jobs a farm (or in an office) and actually looks quite relaxing. While the picking could of course be automated, this is no small task, especially when your business is food production, not robotics.

Power is provided from four 250 W solar panels on the roof, which charge a bank of deep cycle batteries and the drive train. A pure sine wave converter provides power to a 240 V motor driver which turns it back into DC to run the drive motor. [Andrew] admits this back and forth voltage conversion is overcomplicated and inefficient but it’s the sort of thing that quickly happens when you hack a hacked design. The axle and 5-speed gearbox was salvaged from an old 3 ton truck and is mounted vertically to save space. The hydraulic steering is controlled by one of the human weed pickers, who just makes small course corrections as required.

We love the weird combo of old and new in this hack. Check out the machine in action and detailed walk-around after the break.

For true automation we’ve seen more than one agricultural robot, and this year’s Hackaday prize again had an agricultural IoT system in the semi-finals.

Tags: solar hacks

15:24
Ubuntu Security Notice USN-4156-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 4156-1 - It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.
Tags:

15:24
Ubuntu Security Notice USN-4156-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 4156-1 - It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.
Tags:

15:24
Ubuntu Security Notice USN-4156-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 4156-1 - It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote attacker could use this issue to cause SDL to crash, resulting in a denial of service, or possibly execute arbitrary code.
Tags:

15:22
Red Hat Security Advisory 2019-3067-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3067-01 - Java Security Services provides an interface between Java Virtual Machine and Network Security Services. It supports most of the security standards and encryption technologies supported by NSS including communication through SSL/TLS network protocols. JSS is primarily utilized by the Certificate Server as a part of the Identity Management System. An implicit trust issue has been addressed.
Tags:

15:22
Red Hat Security Advisory 2019-3067-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3067-01 - Java Security Services provides an interface between Java Virtual Machine and Network Security Services. It supports most of the security standards and encryption technologies supported by NSS including communication through SSL/TLS network protocols. JSS is primarily utilized by the Certificate Server as a part of the Identity Management System. An implicit trust issue has been addressed.
Tags:

15:22
Red Hat Security Advisory 2019-3067-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3067-01 - Java Security Services provides an interface between Java Virtual Machine and Network Security Services. It supports most of the security standards and encryption technologies supported by NSS including communication through SSL/TLS network protocols. JSS is primarily utilized by the Certificate Server as a part of the Identity Management System. An implicit trust issue has been addressed.
Tags:

15:22
Red Hat Security Advisory 2019-3055-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3055-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service, heap overflow, and use-after-free vulnerabilities.
Tags:

15:22
Red Hat Security Advisory 2019-3055-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3055-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service, heap overflow, and use-after-free vulnerabilities.
Tags:

15:22
Red Hat Security Advisory 2019-3055-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3055-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service, heap overflow, and use-after-free vulnerabilities.
Tags:

15:21
Red Hat Security Advisory 2019-3076-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3076-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

15:21
Red Hat Security Advisory 2019-3076-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3076-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

15:21
Red Hat Security Advisory 2019-3076-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3076-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include heap overflow and use-after-free vulnerabilities.
Tags:

15:21
Red Hat Security Advisory 2019-3082-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3082-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3082-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3082-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3082-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3082-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3083-01
» ‎ Packet Storm Security Advisories

Red Hat Security Advisory 2019-3083-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3083-01
» ‎ Packet Storm Security Recent Files

Red Hat Security Advisory 2019-3083-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:21
Red Hat Security Advisory 2019-3083-01
» ‎ Packet Storm Security Misc. Files

Red Hat Security Advisory 2019-3083-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on WildFly. This asynchronous patch is a security update for the wildfly-core package in Red Hat JBoss Enterprise Application Platform 7.2.
Tags:

15:20
Ubuntu Security Notice USN-4155-1
» ‎ Packet Storm Security Advisories

Ubuntu Security Notice 4155-1 - It was discovered that Aspell incorrectly handled certain inputs. An attacker could potentially access sensitive information.
Tags:

15:20
Ubuntu Security Notice USN-4155-1
» ‎ Packet Storm Security Recent Files

Ubuntu Security Notice 4155-1 - It was discovered that Aspell incorrectly handled certain inputs. An attacker could potentially access sensitive information.
Tags:

15:20
Ubuntu Security Notice USN-4155-1
» ‎ Packet Storm Security Misc. Files

Ubuntu Security Notice 4155-1 - It was discovered that Aspell incorrectly handled certain inputs. An attacker could potentially access sensitive information.
Tags:

15:19
Bolt CMS 3.6.10 Cross Site Request Forgery
» ‎ Packet Storm Security Exploits

Bolt CMS version 3.6.10 suffers from a cross site request forgery vulnerability.
Tags:

15:19
Bolt CMS 3.6.10 Cross Site Request Forgery
» ‎ Packet Storm Security Recent Files

Bolt CMS version 3.6.10 suffers from a cross site request forgery vulnerability.
Tags:

15:19
Bolt CMS 3.6.10 Cross Site Request Forgery
» ‎ Packet Storm Security Misc. Files

Bolt CMS version 3.6.10 suffers from a cross site request forgery vulnerability.
Tags:

15:18
sudo 1.8.28 Security Bypass
» ‎ Packet Storm Security Exploits

sudo version 1.8.28 suffers from a security bypass vulnerability.
Tags:

15:18
sudo 1.8.28 Security Bypass
» ‎ Packet Storm Security Recent Files

sudo version 1.8.28 suffers from a security bypass vulnerability.
Tags:

15:18
sudo 1.8.28 Security Bypass
» ‎ Packet Storm Security Misc. Files

sudo version 1.8.28 suffers from a security bypass vulnerability.
Tags:

15:16
ActiveFax Server 6.92 Build 0316 ActiveFaxServiceNT Unquoted Service Path
» ‎ Packet Storm Security Exploits

ActiveFax Server version 6.92 Build 0316 suffers from an ActiveFaxServiceNT unquoted service path vulnerability.
Tags:

15:16
ActiveFax Server 6.92 Build 0316 ActiveFaxServiceNT Unquoted Service Path
» ‎ Packet Storm Security Recent Files

ActiveFax Server version 6.92 Build 0316 suffers from an ActiveFaxServiceNT unquoted service path vulnerability.
Tags:

15:16
ActiveFax Server 6.92 Build 0316 ActiveFaxServiceNT Unquoted Service Path
» ‎ Packet Storm Security Misc. Files

ActiveFax Server version 6.92 Build 0316 suffers from an ActiveFaxServiceNT unquoted service path vulnerability.
Tags:

13:00
Reverse Engineering Liberates Dash Cam Video
» ‎ Hack a Day

If you’ve purchased a piece of consumer electronics in the last few years, there’s an excellent chance that you were forced to use some proprietary application (likely on a mobile device) to unlock its full functionality. It’s a depressing reality of modern technology, and unless you’re willing to roll your own hardware, it can be difficult to avoid. But [krishnan793] decided to take another route, and reverse engineered his DDPAI dash camera so he could get a live video stream from it without using the companion smartphone application.

Like many modern gadgets, the DDPAI camera creates its own WiFi access point that you need to connect to for configuration. By putting his computer’s wireless card into Monitor mode and running Wireshark, [krishnan793] was able to see that the smartphone was communicating with the camera using some type of REST API. After watching the clear-text exchanges for awhile, he not only discovered a few default usernames and passwords, but the commands necessary to configure the camera and start the video stream.

After hitting it with the proper REST messages, an nmap scan confirmed that several new services had started up on the device. Unfortunately, he didn’t get any video when he pointed VLC to the likely port numbers. At this point [krishnan793] checked the datasheet for the camera’s Hi3516E SoC and saw that it supported H.264 encoding. By manually specifying that as the video codec when invoking VLC, it was able to play a video stream from port 6200. A little later, he discovered that port 6100 was serving up the live audio.

Technically that’s all he wanted to do in the first place, as he was looking to feed the video into OpenCV for other projects. But while he was in the area, [krishnan793] also decided to find the download URL for the camera’s firmware, and ran it through binwalk to see what he could find out. Not surprisingly the security turned out to be fairly lax through the entire device, so he was able to glean some information that could be useful for future projects.

Of course, if you’d rather go with the first option and build your own custom dash camera so you don’t have to jump through so many hoops just to get a usable video stream, we’ve got some good news for you.

Tags: car hacks
11:31
Hackaday Prize China Finalists Announced
» ‎ Hack a Day

In the time since the Hackaday Prize was first run it has nurtured an astonishing array of projects from around the world, and brought to the fore some truly exceptional winners that have demonstrated world-changing possibilities. This year it has been extended to a new frontier with the launch of the Hackaday Prize China (Chinese language, here’s a Google Translate link), allowing engineers, makers, and inventors from that country to join the fun. We’re pleased to announce the finalists, from which a winner will be announced in Shenzhen, China on November 23^rd. If you’re in Shenzen area, you’re invited to attend the award ceremony!

All six of these final project entries have been translated into English to help share information about projects across the language barrier. On the left sidebar of each project page you can find a link back to the original Chinese language project entry. Each presents a fascinating look into what people in our global community can produce when they live at the source of the component supply chain. Among them are a healthy cross-section of projects which we’ll visit in no particular order. Let’s dig in and see what these are all about!

Want To Make A Voice Assistant? First, Make Your Own SBC
We’re used to voice assistants from the likes of Google and Amazon, but [dimension] eschews those by creating their own. It’s a two-PCB device, with a board containing display and sound circuitry mated via a PCI-E connector to a tiny self-designed CPU board which is called the Mini-Pi. This is an Allwinner H3-based SBC which we can imagine having applications beyond this project, but the attention to detail of creating an SBC for the project rather than using one off the shelf is very unexpected. The software is derived from the Jasper project which some readers may already be familiar with, and clearly a lot of effort has been put into making a product rather than a benchtop prototype.
Cleaning Robots In Disguise! This robotic floor sweeper is part hexapod, part wheeled.
If you have a Roomba or similar robotic home cleaner, you’ll be aware of its limitations. Obstacles can defeat it, and any challenges such as stairs or uneven surfaces are beyond it. A home sweeping robot with far more versatility comes from [Lìrèn] and takes the form of a Transformers-style hybrid between the type of wheeled machine that we’re used to and a hexapod walker. An extra twist is that the hexapod can detach itself from the wheeled sweeper to access spaces with restricted height such as beneath furniture. At its heart is a HiKey development board, which (from a bit of Google Translate detective work) we think is based upon a Huawei Kirin 970 SoC.
What would a PDA have looked like using 2019 components? The PDA, Re-Invented
There was a time back in the 1990s when the future of mobile computing seemed to lie in the PDA, relatively low-powered small tablets that held time-management and other productivity apps. All of the PDA’s functions have transferred into the smartphone which has delivered on the promise of those early devices and then some, but perhaps there is still a niche for such a device. It’s an avenue [qwert1213131] is exploring with Jakiro, an ESP32 based device sporting both an eInk touchscreen and a small OLED display. It’s interesting, because by revisiting the idea twenty years later with the benefit of components that simply weren’t available to the designers of the originals it can bring some of what was useful in a PDA such as convenience and simplicity along with the integrated wireless and computing power of the ESP and the low-power persistence of the eInk.
Three-sensor motion capture for your arm Motion Capture For The Rest Of Us
If we think of motion capture, it’s likely that scenes of actors wearing body suits covered in lights spring to mind, in the manner of the systems used for example by CGI artists. But the field of motion capture extends across a multitude of projects and technologies from hacked Nintendo PowerGloves upwards. It’s something [fantc] has made an inroad into, with a one-arm motion capture system using three MPU6050 inertial sensors coupled to an MSP430 family CPU. The whole setup is a compact unit strapped to the arm with a couple of smaller sensor boards, and the interfacing is performed via Bluetooth Low Energy. It doesn’t stretch the imagination to see this approach brought to other limbs with more sensors, perhaps creating full-body motion capture without some of the expensive set-up described earlier.
It’s A Handheld Console, But With So Much More Promise! This Pi Compute Module console board has so much potential!
At first sight, [Counterattack]’s handheld game console appears to be nothing special, after all while it is undoubtedly nicely built, it is not the only such project to be found. It’s only when it’s opened up do we gain an insight into why it deserves a second look. This is a complete and very well executed platform for the Raspberry Pi Compute Module 3. This was selected because it has the power required for the most faithful PlayStation emulation, but because the Pi is such a widely-supported and versatile device in itself we can instantly see huge appeal for this device in a host of applications beyond the world of gaming. Using a Pi ties you to one of the official form factors, and the Compute module offers a chance to roll your own Pi. If we consider this console as a roll-your-own Raspberry Pi 3 for portable battery-powered applications it becomes of interest far beyond a few PlayStation games.
The insect hexapod hardware isn’t the clever part Walking Like An Insect
[HarrytheOrange] brings us a hexapod walker, which would be nothing special were it not that its gait is derived from a study of insect movement rather than from a circular motion. In particular his interest lies in the insect’s ability to retain mobility with less than six operational legs, and he details his rather inhumane research methodology. The walker itself appears to be a straightforward enough design, and if the typical Arduino-style walkers we’ve seen are anything to go by we can imagine there is significant room for gait improvement.

The non-Chinese part of the Hackaday community is frequently fascinated by the work emerging from that country. But we know there is a ton of interesting things going on in the engineering communities there that the rest of the world often doesn’t have the chance to enjoy. What began as a few lone voices giving us a peek at their world is beginning to expand to a flow of interesting work share by the Chinese hardware hacking community to the excitement of non-Chinese-speaking hardware geeks everywhere. We hope that this competition helps to continue that trend, and if the high quality of these projects is anything to go by, we look forward to the Hackaday Prize China returning in future. Congratulations to these finalists, and all who entered!

Tags: contests
10:00
How to Build the Strongest Arches
» ‎ Hack a Day

When it comes to architectural features, there are probably not many as quintessentially memorable as arches. From the simplicity of the curved structure to the seemingly impossible task of a supposedly collapsable shape supporting so much weight in mid-air, they’ve naturally fascinated architects for generations.

For civil engineers, learning to calculate the forces acting on an arch, the material strength and properties, and the weight distribution across several arches may be familiar, but for anyone with only a basic physics and CAD background, it’s easy to take arches for granted. After all, they grace the Roman aqueducts, the Great Wall of China, and are even present in nature at Arches National Park. We see them in cathedrals, mosques, gateways, and even memorialized in the case of the St. Louis Gateway Arch. Even the circular construction of watch towers and wells, as well as our own rib cages, are due to the properties of arches.

But what really goes into constructing a strong arch?
Basic Concepts
Arches share many key concepts with chains. For one, the weight of the arch does not contribute to its shape, but the distance between its ends does. Every shape formed within an arch of a certain length (measured by its circumference) is known as a catenary, with similarities to parabola.

[University of Waterloo]While not all arches are built from bricks, all arches do exhibit tension between points of contact of their construction material, forming a compression system of connectors pushing against each other. This works to a builder’s advantage, as the friction between materials coupled with this tension allows the materials to stay in place.

While arches do end up being durable and long-lasting structures, when they are not shaped appropriately for the loads they are meant to carry, they can collapse. Given the similarities between arches and chains, the angles needed to carry loads in the chain (a tension system) can be mirrored in the angles needed for an arch to carry the same loads.
Image source: [KK Clark]
The Basilica of the Sagrada Familia in Barcelona uses the same techniques for its magnificent arches. Architect Antoni Gaudí initially built an upside-down model of the basilica, adding weights proportional to the roofs and other features he intended on adding to the structure. The resulting profile was the exact shape necessary for his arches to support the weight of the rest of the basilica.

For bridges, since there are not heavy static forces, so long as the arch has sufficient weight of its own, it does not need to take into account the position of its loads. This is due to the fact that similar to adding weights to a heavy or light chain, the heavier the arch, the less it transforms from the application of loads.
Modifying Arches
One interesting quandary for most people is figuring out which arches are able to support their own weight. University of Waterloo professor Wayne Brodland explains in his course on engineering models that as long as an arch is a mirror image of a chain of the same length hung from the same end points, then its shape is valid and can stand under its own weight.

This accounts for heavier semicircular arches, lighter arches with wider endpoints, and taller arches with closer endpoints and is known as the chain test. The test requires that a chain be able to fit within the arch when it is mirrored upside down. This also explains why thicker arches are able to adopt shapes that thinner arches cannot.

Another option is to adapt the shape of the chain to the shape of the arch. Since this requires outward forcing pulling on the chain, reversing these forces to push inwards on the arch allows it to hold up its shape.

[via University of Waterloo]The forces applied to the ends of an arch are vector forces: pushing not just down, but also out. These two forces are balanced out by the normal force perpendicular to the surface and the frictional force parallel to the surface. If the forces produced by the arch are greater than the forces balancing the arch, particularly if the horizontal force is greater than the friction force needed to keep the endpoints in place, then the arch can collapse. For this reason, increasing surface friction can help an arch stay in place. In construction projects, end supports for arches are often angled to better transfer the forces to the arch’s endpoints.
Arch Supports
Rather than simply modifying the end points, however, the horizontal forces can also be provided by the stuff that surrounds the arch. Often, this takes the form of bricks and concrete around bridge.

[via University of Waterloo]For multiple arches in a row, the horizontal forces at their ends can be made to balance, with each arch providing the necessary balancing forces for adjacent arches. The allows them to be supported by thinner columns.

In the case of the Hoover Dam, the shape of the structure holding back the water in the dam is shaped as an arch on its side, with the load against the top of the arch. In this example, it’s clear that the shape of the arch can be mirrored in the shape of a chain.

[via University of Waterloo]Not all arches are structural, however, and often times bridges will use arches simply as decorative features. Nonetheless, it’s clear that there’s a more to know about arches than we knew initially – maybe you’ll incorporate some of these concepts into your next build project!

[Thanks to Chris Lam for the tip!]

Tags: hackaday Columns

8:55
Hacking The PS2 With Yabasic
» ‎ Packet Storm Security Recent Files

Whitepaper that discusses hacking the Sony Playstation 2 with Yabasic.
Tags:

8:55
Hacking The PS2 With Yabasic
» ‎ Packet Storm Security Misc. Files

Whitepaper that discusses hacking the Sony Playstation 2 with Yabasic.
Tags:

8:30
A DIY Bench-Sized Milling Machine
» ‎ Hack a Day

Hanging around the machining community online, you’d be more than familiar with clapped out Bridgeport mills, which are practically a meme at this point. But mills come in all shapes and sizes, from the stout old iron from the days of yore, to smaller, compact builds. [Honus] decided to build the latter, and shared the details of the project.

The aim of [Honus’s] build is to create a small benchtop mill, capable of handling the smaller tasks. The frame of the mill is built out of 80/20 extrusion, with plenty of aluminium plate to go along with it. Igus linear slides handle the X, Y and Z axes. An old brushed Makita drill motor serves as the spindle drive, controlled by an old R/C speed controller hooked up to an Arduino. [Honus] then fabbed up various bits and pieces as neccessary to bring it all together.

The mill is neat and tidy, and looks to do a good job machining aluminium. We imagine it should prove highly useful in [Honus’s] workshop. If you’re contemplating getting yourself some desk-sized tools, perhaps consider an engraver as well! Video after the break.

Tags: tool hacks
7:01
The Final Days of the Fire Lookouts
» ‎ Hack a Day

For more than a century, the United States Forest Service has employed men and women to monitor vast swaths of wilderness from isolated lookout towers. Armed with little more than a pair of binoculars and a map, these lookouts served as an early warning system for combating wildfires. Eventually the towers would be equipped with radios, and later still a cellular or satellite connection to the Internet, but beyond that the job of fire lookout has changed little since the 1900s.

Like the lighthouse keepers of old, there’s a certain romance surrounding the fire lookouts. Sitting alone in their tower, the majority of their time is spent looking at a horizon they’ve memorized over years or even decades, carefully watching for the slightest whiff of smoke. The isolation has been a prison for some, and a paradise for others. Author Jack Kerouac spent the summer of 1956 in a lookout tower on Desolation Peak in Washington state, an experience which he wrote about in several works including Desolation Angels.

But slowly, in a change completely imperceptible to the public, the era of the fire lookouts has been drawing to a close. As technology improves, the idea of perching a human on top of a tall tower for months on end seems increasingly archaic. Many are staunchly opposed to the idea of automation replacing human workers, but in the case of the fire lookouts, it’s difficult to argue against it. Computer vision offers an unwavering eye that can detect even the smallest column of smoke amongst acres of woodland, while drones equipped with GPS can pinpoint its location and make on-site assessments without risk to human life.

At one point, the United States Forest Service operated more than 5,000 permanent fire lookout towers, but today that number has dwindled into the hundreds. As this niche job fades even farther into obscurity, let’s take a look at the fire lookout’s most famous tool, and the modern technology poised to replace it.

The Osborne Firefinder
At the most basic level, the job of the fire lookout is to detect and locate the first signs of a possible fire. This boils down to carefully scanning the horizon for signs of smoke, and if seen, plotting the position of the plume on a map and communicating its location to the on-duty fire crews. All a fire lookout actually needs to accomplish this task is a map of the area he or she is monitoring, and ideally a pair of binoculars or a small telescope. Indeed, prior to the 20th century, this would have been the extent of the equipment available.

But in 1911, William Bushnell Osborne invented the tool which would ultimately become the hallmark of the fire lookout: the Osborne Firefinder. The device, a type of alidade, featured a large circular map of the surrounding area and a sighting apparatus that rotated above it. Some variations of the Firefinder used what was effectively a rifle scope, but others used a “peep” sight that was nothing more than a strip of metal with a small hole drilled into it. In either case, the operator would rotate the Firefinder until they could see the base of the smoke column through the sights.

The center of the circular map represented the location of the tower, with compass headings marked around the entire circumference. When the smoke was sighted in, the degrees of rotation marked by the Firefinder would correspond to the azimuth of the target. This heading could be forwarded to other nearby towers and, assuming they could see the smoke from their vantage point, allowed for triangulation of the fire’s location.

If there were no other towers in the area, or they were unable to see the smoke from their position, the operator of the Firefinder could employ the elevation measurement marks on the sights to estimate distance. With the compass heading and an idea of how distant the smoke was from the base of the tower, crews on the ground would at least have enough information to start their search.

Back to the Future
The Osborne Firefinder was a simple device with few moving parts, and yet when properly set up and calibrated, allowed fire lookouts to locate potential danger with unparalleled accuracy for the era. Realistically, the United States Forest Service didn’t have a better way of pinpointing the location of a fire until the use of aircraft became practical. But even still, the Firefinder was a compelling option as it was cheap and easy to use.

Moreover, the Firefinder went through its own evolution over the years, with new variations steadily increasing its accuracy and utility. These incremental updates culminated with the 1934 version, of which more than 3,000 were manufactured and distributed to lookout towers both domestically and abroad. Incredibly, this version was still being manufactured in the United States up until 1989.
The prototype SDTDC Firefinder
But by the 2000s, there was a problem. With original Osborne Firefinders still in use all over the country, and the supply of spare parts dwindling, the Forest Service’s San Dimas Technology and Development Center (SDTDC) decided to investigate replicating the vintage devices. The various models of the Firefinder were compared, disassembled, and modeled in AutoCAD. Some slight modifications were made based on input from veteran fire lookouts, and prototypes of the new and improved 2003 model Firefinder were built and tested at the Odell Butte and Green Mountain lookout towers in Oregon.

After the successful test program, Palmquist Tooling in California began manufacturing new Firefinders and replacement parts that were largely backwards compatible with the original models. Upgrades for the modern Firefinders included replacing cast iron components with aluminum to save weight, and the addition of nylon bearings to reduce wear.
Eyes in the Sky
Firefinders, whether original Osborne or the updated SDTDC versions, are still actively being used today. Given the fixed location of the tower as a reference point, they give lookouts a simple and reliable way to determine with reasonable accuracy the coordinates of a potential fire. But the reality is that automated systems can do the same job faster and with a much higher degree of accuracy than any human.

Currently, there are a number of different high-tech approaches being used or considered for fire detection. A new space-based system was just brought online over the summer that uses data from several orbiting spacecraft, including the latest GOES weather satellites, to provide continuous monitoring of potential or ongoing wildfires. With updates being pushed out as quickly as once per minute, the system gives emergency agencies a high-level view of the situation in nearly real-time, allowing for efforts to be coordinated far more efficiently than was possible in the past.

But there’s only so much that can be seen from space. To provide a closer view of conditions on the ground without endangering human life, several small Unmanned Aerial Vehicles (UAVs) have been approved for use in and around active wildfires for the purposes of on-site monitoring. These craft can get far closer to the fire than manned vehicles or firefighters can, and provide crucial information on how best to combat it. Similar UAVs proved invaluable during the blaze at Notre Dame cathedral, and represent something of a revolution in close-quarters firefighting technology.
The Silent Falcon, a solar electric UAV used for wildfire monitoring Freaks on the Peaks
It’s undeniable that technology has largely supplanted the fire lookouts at this point. The US Forest Service actually rents out many of the towers as summer vacation cabins now, as the task they were built for has been antiquated by satellites and UAVs. But in the parts of the country where the towers are still staffed with self-identified “Freaks on the Peaks”, the old ways are alive and well.

Even with all the modern technology available, human lookouts can still be a viable option. For one, they’re cheap: most fire lookouts are employed only during the summer months and paid an average of $12 USD per hour. Some of the lookouts have been stationed at the same tower for decades, which gives them invaluable experience with the nuances of the land that can be critical in a crisis. Operating conditions also need to be taken into consideration: UAVs have a difficult time flying in the summer thunderstorms which have been known to trigger wildfires.

With time, even these advantages are likely to be overcome by newer and more advanced automated systems. But until then, a small army of men and women will still climb their towers every spring and keep vigil over the forest with little to keep them company beyond an Osborne Firefinder that was likely built decades before they were born.

Tags: current Events

6:53
Debian Security Advisory 4543-1
» ‎ Packet Storm Security Advisories

Debian Linux Security Advisory 4543-1 - Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID - -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.
Tags:

6:53
Debian Security Advisory 4543-1
» ‎ Packet Storm Security Recent Files

Debian Linux Security Advisory 4543-1 - Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID - -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.
Tags:

6:53
Debian Security Advisory 4543-1
» ‎ Packet Storm Security Misc. Files

Debian Linux Security Advisory 4543-1 - Joe Vennix discovered that sudo, a program designed to provide limited super user privileges to specific users, when configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, allows to run commands as root by specifying the user ID - -1 or 4294967295. This could allow a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access.
Tags:

6:53
Slackware Security Advisory - sudo Updates
» ‎ Packet Storm Security Advisories

Slackware Security Advisory - New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
Tags:

6:53
Slackware Security Advisory - sudo Updates
» ‎ Packet Storm Security Recent Files

Slackware Security Advisory - New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
Tags:

6:53
Slackware Security Advisory - sudo Updates
» ‎ Packet Storm Security Misc. Files

Slackware Security Advisory - New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
Tags:

Skip to page: 1 2 3 4 ... 929

Feeds

Recent items

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags: