Twenty Year Anniversary

Recent Files

Files RSS Feed
Red Hat Security Advisory 2018-2918-01
Posted Oct 16, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2918-01 - The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Issues addressed include a bypass vulnerability.

tags | advisory, bypass
systems | linux, redhat
Ubuntu Security Notice USN-3793-1
Posted Oct 16, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3793-1 - Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. It was discovered that if a user saved passwords before Thunderbird 58 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, local
systems | linux, ubuntu
Ubuntu Security Notice USN-3792-1
Posted Oct 16, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3792-1 - It was discovered that Net-SNMP incorrectly handled certain certain crafted packets. A remote attacker could possibly use this issue to cause Net-SNMP to crash, resulting in a denial of service.

tags | advisory, remote, denial of service
systems | linux, ubuntu
WordPress Support Board 1.2.3 Cross Site Scripting
Posted Oct 16, 2018
Authored by Ismail Tasdelen

WordPress Support Board plugin version 1.2.3 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
Library CMS 2.1.1 Cross Site Scripting
Posted Oct 16, 2018
Authored by Ismail Tasdelen

Library CMS version 2.1.1 suffers from a cross site scripting vulnerability.

tags | exploit, xss
Solaris RSH Stack Clash Privilege Escalation
Posted Oct 15, 2018
Authored by Brendan Coles, Qualys Security Advisory | Site metasploit.com

This Metasploit module exploits a vulnerability in RSH on unpatched Solaris systems which allows users to gain root privileges. The stack guard page on unpatched Solaris systems is of insufficient size to prevent collisions between the stack and heap memory, aka Stack Clash. This Metasploit module uploads and executes Qualys' Solaris_rsh.c exploit, which exploits a vulnerability in RSH to bypass the stack guard page to write to the stack and create a SUID root shell. This Metasploit module has offsets for Solaris versions 11.1 (x86) and Solaris 11.3 (x86). Exploitation will usually complete within a few minutes using the default number of worker threads (10). Occasionally, exploitation will fail. If the target system is vulnerable, usually re-running the exploit will be successful. This Metasploit module has been tested successfully on Solaris 11.1 (x86) and Solaris 11.3 (x86).

tags | exploit, shell, x86, root
systems | solaris
FLIR Systems FLIR Brickstream 3D+ Unauthenticated RTSP Stream Disclosure
Posted Oct 15, 2018
Authored by LiquidWorm | Site zeroscience.mk

The FLIR Brickstream 3D+ sensor is vulnerable to unauthenticated and unauthorized live RTSP video stream access.

tags | exploit
FLIR Systems FLIR Brickstream 3D+ Unauthenticated Config Download File Disclosure
Posted Oct 15, 2018
Authored by LiquidWorm | Site zeroscience.mk

The FLIR Brickstream 3D+ sensor is vulnerable to unauthenticated config download and file disclosure vulnerability when calling the ExportConfig REST API (getConfigExportFile.cgi). This will enable the attacker to disclose sensitive information and help her in authentication bypass, privilege escalation and/or full system access.

tags | exploit, cgi
FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Hard-coded Credentials Shell Access
Posted Oct 15, 2018
Authored by LiquidWorm | Site zeroscience.mk

FLIR AX8 thermal sensor camera devices version 1.32.16 utilize hard-coded credentials within its Linux distribution image. These sets of credentials (SSH) are never exposed to the end-user and cannot be changed through any normal operation of the camera. Attacker could exploit this vulnerability by logging in using the default credentials for the web panel or gain shell access.

tags | exploit, web, shell
systems | linux
Ubuntu Security Notice USN-3790-1
Posted Oct 15, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3790-1 - It was discovered that Requests incorrectly handled certain HTTP headers. An attacker could possibly use this issue to access sensitive information.

tags | advisory, web
systems | linux, ubuntu
FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Arbitrary File Disclosure
Posted Oct 15, 2018
Authored by LiquidWorm | Site zeroscience.mk

The FLIR AX8 thermal sensor camera version 1.32.16 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed via the 'file' parameter in download.php is not properly verified before being used to download config files. This can be exploited to disclose the contents of arbitrary files via absolute path.

tags | exploit, arbitrary, php
FLIR Systems FLIR AX8 Thermal Camera 1.32.16 RTSP Stream Disclosure
Posted Oct 15, 2018
Authored by LiquidWorm | Site zeroscience.mk

The FLIR AX8 thermal sensor camera version 1.32.16 suffers an unauthenticated and unauthorized live RTSP video stream access.

tags | exploit
Advanced HRM 1.6 Remote Code Execution
Posted Oct 15, 2018
Authored by Renos Nikolaou

Advanced HRM version 1.6 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
Centos Web Panel 0.9.8.480 XSS / LFI / Code Execution
Posted Oct 15, 2018
Authored by Siber Guvenlik Hizmetleri

Centos Web Panel version 0.9.8.480 suffers from code execution, cross site scripting, and local file inclusion vulnerabilities.

tags | exploit, web, local, vulnerability, code execution, xss, file inclusion
systems | linux, centos
MaxOn ERP Software 8.x / 9.x SQL Injection
Posted Oct 15, 2018
Authored by Ihsan Sencan

MaxOn ERP Software versions 8.x and 9.x suffer from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
College Notes Management System 1.0 SQL Injection
Posted Oct 15, 2018
Authored by Ihsan Sencan

College Notes Management System version 1.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
Academic Timetable Final Build 7.0b Cross Site Request Forgery
Posted Oct 15, 2018
Authored by Ihsan Sencan

Academic Timetable Final Build version 7.0b suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
Academic Timetable Final Build 7.0a / 7.0b SQL Injection
Posted Oct 15, 2018
Authored by Ihsan Sencan

Academic Timetable Final Build versions 7.0a and 7.0b suffer from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
FLIR Systems FLIR AX8 Thermal Camera 1.32.16 Remote Root
Posted Oct 15, 2018
Authored by LiquidWorm | Site zeroscience.mk

The FLIR AX8 thermal sensor camera version 1.32.16 suffers from two unauthenticated command injection vulnerabilities. The issues can be triggered when calling multiple unsanitized HTTP GET/POST parameters within the shell_exec function in res.php and palette.php file. This can be exploited to inject arbitrary system commands and gain root remote code execution.

tags | exploit, remote, web, arbitrary, root, php, vulnerability, code execution
Ghostscript .loadfontloop Exposed System Operators
Posted Oct 15, 2018
Authored by Tavis Ormandy, Google Security Research

Ghostscript suffers from an issue where .loadfontloop exposes system operators in the saved execution stack.

tags | advisory
Alchemy CMS 4.1-Stable Cross Site Scripting
Posted Oct 14, 2018
Authored by Ismail Tasdelen

Alchemy CMS version 4.1-Stable suffers from a cross site scripting vulnerability.

tags | exploit, xss
BigTree CMS 4.2.23 Cross Site Scripting
Posted Oct 14, 2018
Authored by Ismail Tasdelen

BigTree CMS version 4.2.23 suffers from a cross site scripting vulnerability.

tags | exploit, xss
Mozilla Firefox Picture Drag And Drop Security Bypass
Posted Oct 13, 2018
Authored by Eduardo Braun Prado

Proof of concept exploit for a Mozilla Firefox picture drag and drop security bypass vulnerability. Tested on versions 3.6.10 up to 62.0.3. Password to decompress this archive is ff2018.

tags | exploit, proof of concept, bypass
Snes9K 0.0.9z Buffer Overflow
Posted Oct 13, 2018
Authored by Abdullah Alic

Snes9K version 0.0.9z SEH buffer overflow proof of concept exploit.

tags | exploit, overflow, proof of concept
D-Link DSL-2640T Cross Site Scripting
Posted Oct 12, 2018
Authored by Anas Falhi

D-Link DSL-2640T suffers from a cross site scripting vulnerability.

tags | exploit, xss
View Older Files →

Recent News

News RSS Feed
Californian Man Gets Six Months For Assisting Russian Trolls
Posted Oct 12, 2018

tags | headline, government, usa, russia, fraud, cyberwar
A Mysterious Grey Hat Is Patching People's Outdated MikroTik Routers
Posted Oct 12, 2018

tags | headline, hacker, flaw, patch
Facebook Shuts Down Spammy Politics Pages
Posted Oct 12, 2018

tags | headline, government, fraud, cyberwar, facebook, social
Fake Adobe Flash Updates Hide Malicious Crypto Miners
Posted Oct 12, 2018

tags | headline, malware, flaw, adobe, cryptography
Cops Arrest Infamous SIM Swapper Who Stole Crypto Currency
Posted Oct 11, 2018

tags | headline, phone, cybercrime, fraud, cryptography
Hackers Breach Web Hosting Provider For The Second Time In The Past Year
Posted Oct 11, 2018

tags | headline, hacker, privacy, data loss
US Weapons Systems Can Be Easily Hacked
Posted Oct 11, 2018

tags | headline, hacker, government, usa, flaw, cyberwar, military
Network Time Protocol Bugs Sting Juniper Operating System
Posted Oct 11, 2018

tags | headline, flaw, juniper
Four Critical Flaws Patched In Adobe Digital Edition
Posted Oct 11, 2018

tags | headline, malware, flaw, adobe, patch
GAO Report Slams DoD Cyber Security Practices
Posted Oct 11, 2018

tags | headline, government, usa, cyberwar
View More News →

File Archive:

October 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    26 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    2 Files
  • 7
    Oct 7th
    3 Files
  • 8
    Oct 8th
    23 Files
  • 9
    Oct 9th
    16 Files
  • 10
    Oct 10th
    15 Files
  • 11
    Oct 11th
    19 Files
  • 12
    Oct 12th
    16 Files
  • 13
    Oct 13th
    2 Files
  • 14
    Oct 14th
    2 Files
  • 15
    Oct 15th
    15 Files
  • 16
    Oct 16th
    5 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

News Tags

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close