Full Disclosure
Posted by Kacper Szurek on Feb 06
# Exploit: IVPN Client for Windows 2.6.6120.33863 Privilege Escalation
# Date: 06.02.2017
# Software Link: https://www.ivpn.net/
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: local
1. Description
It is possible to run `openvpn` as `SYSTEM` with custom openvpn.conf.
Using `–up cmd` we can execute any command….
Posted by Graph-X on Feb 06
#############################################################
# Advisory Title: Teleopti WFM (Multiple Vulnerabilities)
# Date: 2/4/2017
# Researcher: Graph-X ((email: graphx () sigaint org))
# Vendor Homepage: http://www.teleopti.com
# Version: <= 7.1.0
# CVE: is dead
#############################################################
Disclosure Timeline…
Posted by Egidio Romano on Feb 06
—————————————————————————
PEAR HTML_AJAX <= 0.5.7 (PHP Serializer) PHP Object Injection Vulnerability
—————————————————————————
[-] Software Link:
https://pear.php.net/package/HTML_AJAX
[-] Affected Versions:
All versions from 0.3.0 to 0.5.7.
[-] Vulnerability Description:
The vulnerable code is located within the HTML_AJAX_Serializer_PHP…
Posted by John Marzella on Feb 04
==========================================================================
Product: ZoneMinder
Versions: Multiple versions – see inline
Vulnerabilities: File disclosure, XSS, CSRF, Auth bypass & Info disclosure
CVE-IDs: CVE-2017-5595, CVE-2017-5367, CVE-2017-5368, CVE-2016-10140
Author: John Marzella
Date: 03/02/2017
==========================================================================
CVE-2016-10140 – Auth bypass and Info disclosure -…
Posted by FOXMOLE Advisories on Feb 02
=== FOXMOLE – Security Advisory 2016-07-05 ===
Zoneminder multiple vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Affected Versions
=================
Zoneminder 1.29,1.30
Issue Overview
==============
Vulnerability Type: SQL Injection, Cross Site Scripting, Session Fixation, No CSRF Protection
Technical Risk: high
Likelihood of Exploitation: medium
Vendor: Zoneminder
Vendor URL: https://zoneminder.com/
Credits: FOXMOLE employee Tim Herres…
Posted by Pierre Kim on Feb 02
Hello,
Following the advisory posted to FD and Buqtraq about the Dlink DWR-932B router,
the complete version on analyzing the security on the corrected
firmware for Dlink 932B LTE
routers is posted here:
https://pierrekim.github.io/blog/2017-02-02-update-dlink-dwr-932b-lte-routers-vulnerabilities.html
Please find a text-only version below sent to security mailing lists.
=== text-version of the advisory ===
An update on this post:
MITRE…
Posted by elendil el on Feb 02
Hi,
Thanks for sharing, though I am not sure this is the right mailing list to
do so (imo).
However, you seem to raise an interesting point. @List: Do we have stuff
going on the mainframe guys ? 0days, vulns, exploits, etc ?
I’ve gone through FD archives but could not get something.
Thanks !
2017-01-29 12:11 GMT+01:00 Sparc Flow <sparc.flow () protonmail com>:
Posted by Peter Kruse on Feb 02
Hi,
We are proud to announce the “Call for Speakers” and “Save the Date” for the 5th Copenhagen #cybercrime Conference to
be held on the 24th of May 2017 in Copenhagen, Denmark.
More details:
http://www.cyberhagen.com
Event registration will open shortly.
Please no marketing presentations.
CCCC17 is about knowledge sharing, no sales.
Cheers,
Peter
Posted by Info on Feb 02
HP Printers Wi-Fi Direct Improper Access Control
——————————————————————————–
1. Advisory Information
Title: HP Printers Wi-Fi Improper Access Control
Advisory ID: NESESO-2017-0111
Advisory URL: http://neseso.com/advisories/NESESO-2017-0111.pdf
Date published: 2017-02-01
Date of last update: 2017-02-01
Vendors contacted: Hewlett Packard
Release mode: User Release…
Posted by Tobias Glemser on Feb 01
secuvera-SA-2017-02: Reflected XSS and Open Redirect in MailStore Server
Affected Products
MailStore Server Version 10.0.1.12148 was tested
according to the vendor:
– MailStore 9.2 to 10.0.1 is affected by the Reflected XSS Vulnerability
– Mailstore 9.0 to 10.0.1 is affected by the Open Redirect Vulnerability
References
https://www.secuvera.de/advisories/secuvera-SA-2017-02.txt
CWE-79…