what you don't know can hurt you

Recent Files

Files RSS Feed
Oracle Business Intelligence Directory Traversal
Posted Apr 19, 2019
Authored by Vahagn Vardanyan

Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0 suffer from a directory traversal vulnerability.

tags | exploit, file inclusion
Oracle Business Intelligence And XML Publisher XML Injection
Posted Apr 19, 2019
Authored by Vahagn Vardanyan

Oracle Business Intelligence and XML Publisher versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0 suffer from an XML external entity injection vulnerability.

tags | exploit
QNAP myQNAPcloud Connect 1.3.4.0317 Username/Password Denial Of Service
Posted Apr 19, 2019
Authored by Dino Covotsos

QNAP myQNAPcloud Connect version 1.3.4.0317 suffers from a username / password denial of service vulnerability.

tags | exploit, denial of service
SystemTap 1.3 MODPROBE_OPTIONS Privilege Escalation
Posted Apr 19, 2019
Authored by Tavis Ormandy, Brendan Coles | Site metasploit.com

This Metasploit module attempts to gain root privileges by exploiting a vulnerability in the staprun executable included with SystemTap version 1.3. The staprun executable does not clear environment variables prior to executing modprobe, allowing an arbitrary configuration file to be specified in the MODPROBE_OPTIONS environment variable, resulting in arbitrary command execution with root privileges. This module has been tested successfully on: systemtap 1.2-1.fc13-i686 on Fedora 13 (i686); and systemtap 1.1-3.el5 on RHEL 5.5 (x64).

tags | exploit, arbitrary, root
systems | linux, fedora
Atlassian Confluence Widget Connector Macro Velocity Template Injection
Posted Apr 18, 2019
Authored by Dmitry Shchannikov, Daniil Dmitriev | Site metasploit.com

Widget Connector Macro is part of Atlassian Confluence Server and Data Center that allows embed online videos, slideshows, photostreams and more directly into page. A _template parameter can be used to inject remote Java code into a Velocity template, and gain code execution. Authentication is not required to exploit this vulnerability. By default, Java payload will be used because it is cross-platform, but you can also specify which native payload you want (Linux or Windows). Confluence before version 6.6.12, from version 6.7.0 before 6.12.3, from version 6.13.0 before 6.13.3 and from version 6.14.0 before 6.14.2 are affected.

tags | exploit, java, remote, code execution
systems | linux, windows
Ubuntu Security Notice USN-3950-1
Posted Apr 18, 2019
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3950-1 - It was discovered that ZNC incorrectly handled certain invalid encodings. An authenticated remote user could use this issue to cause ZNC to crash, resulting in a denial of service, or possibly execute arbitrary code.

tags | advisory, remote, denial of service, arbitrary
systems | linux, ubuntu
Netwide Assembler (NASM) 2.14rc15 Null Pointer Dereference
Posted Apr 18, 2019
Authored by Fakhri Zulkifli

Netwide Assembler (NASM) version 2.14rc15 null pointer dereference proof of concept exploit.

tags | exploit, proof of concept
ManageEngine Applications Manager 14 SQL Injection / Remote Code Execution
Posted Apr 18, 2019
Authored by Ozkan Mustafa Akkus | Site metasploit.com

This Metasploit module exploits SQL injection and command injection vulnerabilities in ManageEngine AM 14 and prior versions. An unauthenticated user can gain the authority of "system" on the server due to the SQL injection vulnerability. The exploit allows the writing of the desired file to the system using the postgresql structure. The module is written over the payload by selecting a file with the extension ".vbs" that is used for monitoring by the ManageEngine which working with "system" authority. In addition, it dumps the users and passwords from the database for us. After the harmful ".vbs" file is written, the shell session may be a bit late.

tags | exploit, shell, vulnerability, sql injection
Evernote 7.9 Path Traversal / Code Execution
Posted Apr 18, 2019
Authored by Mishra Dhiraj

Evernote version 4.9 suffers from a path traversal that can allow for code execution.

tags | exploit, code execution, file inclusion
Redacted Report On The Investigation Into Russian Interference In The 2016 Presidential Election
Posted Apr 18, 2019
Authored by Special Counsel Robert S. Mueller III | Site justice.gov

Released 2019/04/18 by the United States Justice Department, this is the Report On The Investigation Into Russian Interference In The 2016 Presidential Election. This is the redacted version.

tags | paper
OpenSSH 8.0p1
Posted Apr 18, 2019
Authored by Damien Miller | Site openssh.com

This is a Linux/portable port of OpenBSD's excellent OpenSSH. OpenSSH is based on the last free version of Tatu Ylonen's SSH with all patent-encumbered algorithms removed, all known security bugs fixed, new features reintroduced, and many other clean-ups.

Changes: Various bug fixes and updates.
tags | tool, encryption
systems | linux, unix, openbsd
Slackware Security Advisory - libpng Updates
Posted Apr 18, 2019
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New libpng packages are available for Slackware 14.2 and -current to fix security issues.

tags | advisory
systems | linux, slackware
LibreOffice Macro Code Execution
Posted Apr 17, 2019
Authored by Alex Infuhr, Shelby Pace | Site metasploit.com

This Metasploit module generates an ODT file with a mouse over event that when triggered, will execute arbitrary code.

tags | exploit, arbitrary
Gentoo Linux Security Advisory 201904-19
Posted Apr 17, 2019
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201904-19 - Multiple vulnerabilities have been found in Dovecot, the worst of which could result in root privilege escalation. Versions less than 2.3.5.1 are affected.

tags | advisory, root, vulnerability
systems | linux, gentoo
Red Hat Security Advisory 2019-0782-01
Posted Apr 17, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0782-01 - The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API. Issues addressed include code execution and deserialization vulnerabilities.

tags | advisory, vulnerability, code execution
systems | linux, redhat
Gentoo Linux Security Advisory 201904-18
Posted Apr 17, 2019
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201904-18 - A vulnerability in libseccomp allows for privilege escalation. Versions less than 2.4.0 are affected.

tags | advisory
systems | linux, gentoo
Ubuntu Security Notice USN-3914-2
Posted Apr 17, 2019
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3914-2 - USN-3914-1 fixed vulnerabilities in NTFS-3G. As an additional hardening measure, this update removes the setuid bit from the ntfs-3g binary. A heap buffer overflow was discovered in NTFS-3G when executing it with a relative mount point path that is too long. A local attacker could potentially exploit this to execute arbitrary code as the administrator. Various other issues were also addressed.

tags | advisory, overflow, arbitrary, local, vulnerability
systems | linux, ubuntu
Gentoo Linux Security Advisory 201904-17
Posted Apr 17, 2019
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201904-17 - Multiple vulnerabilities have been found in Patch, the worst of which could result in the execution of arbitrary code. Versions less than 2.7.6-r3 are affected.

tags | advisory, arbitrary, vulnerability
systems | linux, gentoo
Oracle Java Runtime Environment GlyphIterator::setCurrGlyphID Heap Corruption
Posted Apr 17, 2019
Authored by Google Security Research, mjurczyk

A heap corruption was observed in Oracle Java Runtime Environment version 8u202 (latest at the time of this writing) while fuzz-testing the processing of TrueType fonts.

tags | exploit, java
Oracle Java Runtime Environment sc_FindExtrema4 Heap Corruption
Posted Apr 17, 2019
Authored by Google Security Research, mjurczyk

A heap corruption was observed in Oracle Java Runtime Environment version 8u202 (latest at the time of this writing) while fuzz-testing the processing of TrueType, implemented in a proprietary t2k library.

tags | exploit, java
OAMbuster Multi-Threaded CVE-2018-2879 Scanner
Posted Apr 17, 2019
Authored by redtimmysec | Site github.com

OAMbuster is a multi-threaded exploit for CVE-2018-2879.

tags | exploit
Red Hat Security Advisory 2019-0778-01
Posted Apr 17, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0778-01 - The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Issues addressed include a slow conversion of BigDecimal to long.

tags | advisory, java
systems | linux, redhat
Red Hat Security Advisory 2019-0775-01
Posted Apr 17, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0775-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include an out of bounds access vulnerability.

tags | advisory, java
systems | linux, redhat
Red Hat Security Advisory 2019-0774-01
Posted Apr 17, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0774-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Issues addressed include an out of bounds access vulnerability.

tags | advisory, java
systems | linux, redhat
Debian Security Advisory 4433-1
Posted Apr 17, 2019
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4433-1 - Several vulnerabilities have been discovered in the Rubygems included in the interpreter for the Ruby language, which may result in denial of service or the execution of arbitrary code.

tags | advisory, denial of service, arbitrary, vulnerability, ruby
systems | linux, debian
View Older Files →

Recent News

News RSS Feed
Weather Channel Knocked Off-Air In Dangerous Precedent
Posted Apr 19, 2019

tags | headline, denial of service
Facebook Security Lapse Affects Millions More Instragram Users Than First Stated
Posted Apr 19, 2019

tags | headline, privacy, data loss, password, facebook, social
Unexpected Security Feature In Microsoft Edge Subverts IE Security
Posted Apr 19, 2019

tags | headline, microsoft, flaw
Mueller Report Dives Into Russia And Trump
Posted Apr 19, 2019

tags | headline, government, usa, russia, fraud, fbi
State-Sponsored DNS Hijacking Infiltrates 40 Firms Globally
Posted Apr 18, 2019

tags | headline, hacker, government, dns, cyberwar
EA Origin Client Bug Allows Threat Actors To Run Remote Code
Posted Apr 18, 2019

tags | headline, flaw
Facebook Uploaded Email Contacts For 1.5m Users Without Consent
Posted Apr 18, 2019

tags | headline, privacy, email, data loss, fraud, facebook, social
Shopify API Flaw Leaked Revenue Data Of Thousands Of Stores
Posted Apr 18, 2019

tags | headline, privacy, bank, data loss, flaw
US Government Admits It Doesn't Know If Assange Cracked Password For Manning
Posted Apr 17, 2019

tags | headline, hacker, government, usa, britain, data loss, military
Oracle Squashes 53 Critical Bugs In April Security Update
Posted Apr 17, 2019

tags | headline, database, flaw, patch, oracle
View More News →

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    4 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

News Tags

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close