exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 22 of 22 RSS Feed

Files Date: 2023-10-02

Packet Storm New Exploits For September, 2023
Posted Oct 2, 2023
Authored by Todd J. | Site packetstormsecurity.com

This archive contains all of the 122 exploits added to Packet Storm in September, 2023.

tags | exploit
SHA-256 | 0db101468348dcc7851002e0aeaf72c6832cf0d9e58336bd7a6cbcb448d62663
Electrolink FM/DAB/TV Transmitter Pre-Auth MPFS Image Remote Code Execution
Posted Oct 2, 2023
Authored by LiquidWorm | Site zeroscience.mk

Electrolink FM/DAB/TV Transmitter allows access to an unprotected endpoint that allows an MPFS File System binary image upload without authentication. The MPFS2 file system module provides a light-weight read-only file system that can be stored in external EEPROM, external serial Flash, or internal Flash program memory. This file system serves as the basis for the HTTP2 web server module, but is also used by the SNMP module and is available to other applications that require basic read-only storage capabilities. This can be exploited to overwrite the flash program memory that holds the web server's main interfaces and execute arbitrary code.

tags | exploit, web, arbitrary
SHA-256 | ac5f10b56496b87847c741037481ca75bcd2e582224891a5fdf49e523b421ad3
Electrolink FM/DAB/TV Transmitter Unauthenticated Remote Denial Of Service
Posted Oct 2, 2023
Authored by LiquidWorm | Site zeroscience.mk

Electrolink FM/DAB/TV Transmitter from a denial of service scenario. An unauthenticated attacker can reset the board as well as stop the transmitter operations by sending one GET request to the command.cgi gateway.

tags | exploit, denial of service, cgi
SHA-256 | b9b0622841f3107d917cdcd1705a85c49fc9e8558ff56a20647b6b895f6e0b05
Electrolink FM/DAB/TV Transmitter SuperAdmin Hidden Functionality
Posted Oct 2, 2023
Authored by LiquidWorm | Site zeroscience.mk

Electrolink FM/DAB/TV Transmitter allows an unauthenticated attacker to bypass authentication and modify the Cookie to reveal hidden pages that allows more critical operations to the transmitter.

tags | exploit
SHA-256 | 45f211ad4dbcb54d00567ce51f651830505f6738b0f64c25cbfb2bd139946f03
Electrolink FM/DAB/TV Transmitter Vertical Privilege Escalation
Posted Oct 2, 2023
Authored by LiquidWorm | Site zeroscience.mk

Electrolink FM/DAB/TV Transmitter suffers from a privilege escalation vulnerability. An attacker can escalate his privileges by poisoning the Cookie from GUEST to ADMIN to effectively become Administrator or poisoning to ZSL to become Super Administrator.

tags | exploit
SHA-256 | e8e96f31a1023ce46974a3cca9e6ecddcb46a5d4bf193e19d0b57cba7468729f
Electrolink FM/DAB/TV Transmitter Remote Authentication Removal
Posted Oct 2, 2023
Authored by LiquidWorm | Site zeroscience.mk

Electrolink FM/DAB/TV Transmitter suffers from an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. It is also vulnerable to account takeover and arbitrary password change.

tags | exploit, arbitrary
SHA-256 | 3531396821530bd27b027935beb5b1f2474e4ce3397185218b36a45664af9f26
Electrolink FM/DAB/TV Transmitter (Login Cookie) Authentication Bypass
Posted Oct 2, 2023
Authored by LiquidWorm | Site zeroscience.mk

Electrolink FM/DAB/TV Transmitter suffers from an authentication bypass vulnerability affecting the Login Cookie. An attacker can set an arbitrary value except NO to the Login Cookie and have full system access.

tags | exploit, arbitrary, bypass
SHA-256 | f3b6802c80c2e4cb69f633b371d2be514c2309082ed530b0515e8aec53377715
Electrolink FM/DAB/TV Transmitter (controlloLogin.js) Credential Disclosure
Posted Oct 2, 2023
Authored by LiquidWorm | Site zeroscience.mk

Electrolink FM/DAB/TV Transmitter suffers from a disclosure of clear-text credentials in controlloLogin.js that can allow security bypass and system access.

tags | exploit
SHA-256 | 70c3b999a4b5275db8acaed179b976a817ce1f31fa0e23701824e4518bde9ded
Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) Credential Disclosure
Posted Oct 2, 2023
Authored by LiquidWorm | Site zeroscience.mk

The Electrolink FM/DAB/TV Transmitter suffers from a disclosure of clear-text credentials in login.htm and mail.htm that can allow security bypass and system access.

tags | exploit
SHA-256 | c48f747f8c225e4d94444f4ed07ee6455c398bd62f471bedb496b0bc8746b94f
Gentoo Linux Security Advisory 202310-01
Posted Oct 2, 2023
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 202310-1 - Multiple vulnerabilities have been discovered in ClamAV, the worst of which could result in remote code execution. Versions greater than or equal to 0.103.7 are affected.

tags | advisory, remote, vulnerability, code execution
systems | linux, gentoo
advisories | CVE-2022-20698, CVE-2022-20770, CVE-2022-20771, CVE-2022-20785, CVE-2022-20792, CVE-2022-20796, CVE-2022-20803, CVE-2023-20032, CVE-2023-20052
SHA-256 | ca1d69efc4a4e8857de6f7e66d60767c128e79bf7e3366220b15bc21ed14e66b
Debian Security Advisory 5512-1
Posted Oct 2, 2023
Authored by Debian | Site debian.org

Debian Linux Security Advisory 5512-1 - Several vulnerabilities were discovered in Exim, a mail transport agent, which could result in remote code execution if the EXTERNAL or SPA/NTLM authenticators are used.

tags | advisory, remote, vulnerability, code execution
systems | linux, debian
advisories | CVE-2023-42114, CVE-2023-42115, CVE-2023-42116
SHA-256 | a28c2d03163448e0e92324757faf8e3aa4ac5645fdda00d5756c2bf6e82c4a31
Debian Security Advisory 5511-1
Posted Oct 2, 2023
Authored by Debian | Site debian.org

Debian Linux Security Advisory 5511-1 - Several security vulnerabilities have been discovered in mosquitto, a MQTT compatible message broker, which may be abused for a denial of service attack.

tags | advisory, denial of service, vulnerability
systems | linux, debian
advisories | CVE-2021-34434, CVE-2021-41039, CVE-2023-0809, CVE-2023-28366, CVE-2023-3592
SHA-256 | 1518e0099ccd906d33af69afafa10ef3ebd6d28f34c143d4f89b8e793d316b29
TOR Virtual Network Tunneling Tool 0.4.8.7
Posted Oct 2, 2023
Authored by Roger Dingledine | Site tor.eff.org

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

Changes: Fixed an issue that prevented pre-building more conflux sets after existing sets had been used. Regenerate fallback directories generated on September 25, 2023. Updated the geoip files to match the IPFire Location Database, as retrieved on 2023/09/25.
tags | tool, remote, local, peer2peer
systems | unix
SHA-256 | b20d2b9c74db28a00c07f090ee5b0241b2b684f3afdecccc6b8008931c557491
Gentoo Linux Security Advisory 202309-17
Posted Oct 2, 2023
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 202309-17 - Multiple vulnerabilities have been found in Chromium and its derivatives, the worst of which could result in remote code execution. Versions greater than or equal to 113.0.5672.126 are affected.

tags | advisory, remote, vulnerability, code execution
systems | linux, gentoo
advisories | CVE-2023-0696, CVE-2023-0697, CVE-2023-0698, CVE-2023-0699, CVE-2023-0700, CVE-2023-0701, CVE-2023-0702, CVE-2023-0703, CVE-2023-0704, CVE-2023-0705, CVE-2023-0927, CVE-2023-0928, CVE-2023-0929, CVE-2023-0930
SHA-256 | 405a8ef4f4fdb4b2e5acdfa683735dd378fbfb67d3534ee2331748e62162fc10
Gentoo Linux Security Advisory 202309-16
Posted Oct 2, 2023
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 202309-16 - Multiple vulnerabilities have been discovered in wpa_supplicant and hostapd, the worst of which could result in arbitrary code execution. Versions greater than or equal to 2.10 are affected.

tags | advisory, arbitrary, vulnerability, code execution
systems | linux, gentoo
advisories | CVE-2021-30004, CVE-2022-23303, CVE-2022-23304
SHA-256 | ab9712587015dc8f77dfbf72fe294ede502a1c143ab940b07017ea46a539360c
Debian Security Advisory 5510-1
Posted Oct 2, 2023
Authored by Debian | Site debian.org

Debian Linux Security Advisory 5510-1 - Clement Lecigne discovered a heap-based buffer overflow in libvpx, a multimedia library for the VP8 and VP9 video codecs, which may result in the execution of arbitrary code if a specially crafted VP8 media stream is processed.

tags | advisory, overflow, arbitrary
systems | linux, debian
advisories | CVE-2023-5217
SHA-256 | b4dcffb697fe696e6e00d091270e45177bfc156ae9ad8536bd789d4e459ada94
jSQL Injection 0.93
Posted Oct 2, 2023
Authored by ron190 | Site github.com

jSQL Injection is a lightweight application used to find database information from a distant server. jSQL Injection is also part of the official penetration testing distribution Kali Linux and is included in various other distributions like Pentest Box, Parrot Security OS, ArchStrike and BlackArch Linux. This is the source code release.

Changes: Added Boolean no-mode. Added Preference to disable URL random suffix. Fixed empty String not possible in SQL Engine. Add CTF platforms to Scan list.
tags | tool, scanner, sql injection
systems | linux, unix
SHA-256 | 90eb5b359e74a7af8e5bdb5cc5a8740bc57bb1ca10a3bece24054679d6da0016
Juniper SRX Firewall / EX Switch Remote Code Execution
Posted Oct 2, 2023
Authored by Ron Bowes, Jacob Baines, jheysel-r7 | Site metasploit.com

This Metasploit module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls and EX switches. The affected Juniper devices running FreeBSD and every FreeBSD process can access their stdin by opening /dev/fd/0. The exploit also makes use of two useful PHP features. The first being auto_prepend_file which causes the provided file to be added using the require function. The second PHP function is allow_url_include which allows the use of URL-aware fopen wrappers. By enabling allow_url_include, the exploit can use any protocol wrapper with auto_prepend_file. The module then uses data:// to provide a file inline which includes the base64 encoded PHP payload. By default this exploit returns a session confined to a FreeBSD jail with limited functionality. There is a datastore option JAIL_BREAK, that when set to true, will steal the necessary tokens from a user authenticated to the J-Web application, in order to overwrite the root password hash. If there is no user authenticated to the J-Web application this method will not work. The module then authenticates with the new root password over SSH and then rewrites the original root password hash to /etc/master.passwd.

tags | exploit, web, root, php, protocol
systems | freebsd, bsd, juniper
advisories | CVE-2023-36845
SHA-256 | 23552b23e1cc0e2022181944f8894c8f7203e6893e7d1127561c3ffd867b9517
Gentoo Linux Security Advisory 202309-15
Posted Oct 2, 2023
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 202309-15 - Multiple vulnerabilities have been found in GNU Binutils, the worst of which could result in denial of service. Versions greater than or equal to 2.40 are affected.

tags | advisory, denial of service, vulnerability
systems | linux, gentoo
advisories | CVE-2022-38126, CVE-2022-38127, CVE-2022-38128, CVE-2022-38533, CVE-2022-4285, CVE-2023-1579, CVE-2023-1972
SHA-256 | 86ddcc309764b6b66059868311e9f0b2422e461c8da2f228600256baa9c81ff0
Debian Security Advisory 5509-1
Posted Oct 2, 2023
Authored by Debian | Site debian.org

Debian Linux Security Advisory 5509-1 - A buffer overflow in VP8 media stream processing has been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.

tags | advisory, web, overflow, arbitrary
systems | linux, debian
advisories | CVE-2023-5217
SHA-256 | 73d931fd3d0a9ba4c7430142c4e60873dc6b90250043fa116b8116cf5495e494
Debian Security Advisory 5508-1
Posted Oct 2, 2023
Authored by Debian | Site debian.org

Debian Linux Security Advisory 5508-1 - Multiple security issues were discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.

tags | advisory, denial of service, arbitrary, info disclosure
systems | linux, debian
advisories | CVE-2023-5186, CVE-2023-5187, CVE-2023-5217
SHA-256 | 5550e68ba1d2b614ebdd9b77285dea84c54ce37ebdd27ec26f2df951e220f22c
Red Hat Security Advisory 2023-5407-01
Posted Oct 2, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-5407-01 - OpenShift GitOps KAM OpenShift GitOps Kubernetes Application Manager CLI tool. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2023-37788
SHA-256 | 4179d62a9ec66e932deb1b6ce88952b6618765a780b156ba61dcd557810018f1
Page 1 of 1
Back1Next

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close