Digital Whisper Electronic Magazine issue 96. Written in Hebrew.

Digital Whisper Electronic Magazine issue 97. Written in Hebrew.

Digital Whisper Electronic Magazine issue 98. Written in Hebrew.

Digital Whisper Electronic Magazine issue 99. Written in Hebrew.

Digital Whisper Electronic Magazine issue 100. Written in Hebrew.

Digital Whisper Electronic Magazine issue 101. Written in Hebrew.

Digital Whisper Electronic Magazine issue 102. Written in Hebrew.

Digital Whisper Electronic Magazine issue 103. Written in Hebrew.

Digital Whisper Electronic Magazine issue 105. Written in Hebrew.

Digital Whisper Electronic Magazine issue 106. Written in Hebrew.

Digital Whisper Electronic Magazine issue 107. Written in Hebrew.

Digital Whisper Electronic Magazine issue 104. Written in Hebrew.

This is a whitepaper tutorial that describes steps taken to identify post-authentication remote code execution vulnerabilities in ManageEngine version 14.

This Metasploit module exploits a vulnerability on Microsoft Silverlight. The vulnerability exists on the Initialize() method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code (user controlled) it's possible to dereference arbitrary memory which easily leverages to arbitrary code execution. In order to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class from System.Windows.dll. This Metasploit module has been tested successfully on IE6 - IE10, Windows XP SP3 / Windows 7 SP1 on both x32 and x64 architectures.

Source Engine CS:GO BuildID: 4937372 arbitrary code execution exploit.

ManageEngine DataSecurity Plus versions prior to 6.0.1 and ADAudit Plus versions prior to 6.0.3 suffers from a path traversal vulnerability that can lead to remote code execution.

The ManageEngine Asset Explorer windows agent suffers form a remote code execution vulnerability. All versions prior to 1.0.29 are affected.

ManageEngine EventLog Analyzer version 10.0 suffers from an information disclosure vulnerability.

CRYPTOCard's CRYPTOAdmin software is a challenge/response user authentication administration system. The PT-1 token, which runs on a PalmOS device, generates the one-time-password response. A PalmOS .PDB file is created for each user and loaded onto their Palm device. By gaining access to the .PDB file, the legitimate user's PIN can be determined through a series of DES decrypts-and-compares. Using the demonstration tool, the PIN can be determined in under 5 minutes on a Pentium III 450MHz.

Patch for the xine/gxine CD player that was found susceptible to a remote format string bug. The vulnerable code is found in the xine-lib library that both xine and gxine use. The vulnerable versions are at least xine-lib-0.9.13, 1.0, 1.0.1, 1.0.2 and 1.1.0.

A FortiSIEM collector connects to a Supervisor/Worker over HTTPS TLS (443/TCP) to register itself as well as relaying event data such as syslog, netflow, SNMP, etc. When the Collector (the client) connects to the Supervisor/Worker (the server), the client does not validate the server-provided certificate against its root-CA store. Since the client does no server certificate validation, this means any certificate presented to the client will be considered valid and the connection will succeed. If an attacker spoofs a Worker/Supervisor using an ARP or DNS poisoning attack (or any other MITM attack), the Collector will blindly connect to the attacker's HTTPS TLS server. It will disclose the authentication password used along with any data being relayed. Versions 5.0 and 5.2.1 have been tested and are affected.

A git clone action can leak cached / stored credentials for github.com to example.com due to insecure handling of newlines in the credential helper protocol.

Online Shopping System Advanced version 1.0 suffers from a remote SQL injection vulnerability.

Online Course Registration 2.0 suffers from authentication bypass and remote SQL injection vulnerabilities.

Online Scheduling System version 1.0 suffers from a remote SQL injection vulnerability.

Pisay Online E-Learning System version 1.0 suffers from remote SQL Injection and code execution vulnerabilities.

Online Clothing Store version 1.0 suffers from a remote SQL injection vulnerability.

Online AgroCulture Farm Management System version 1.0 suffers from a remote SQL injection vulnerability.