CVE-2018-1113

Related Files

Red Hat Security Advisory 2018-3249-01

Posted Oct 31, 2018

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-3249-01 - The setup package contains a set of important default system configuration and setup files. Examples include /etc/passwd, /etc/group, and /etc/profile. Other examples are the default lists of reserved user IDs, reserved ports, reserved protocols, allowed shells, allowed secure terminals. Issues addressed include a nologin listed in /etc/shells violating security expectations.

tags | advisory, shell, protocol

systems | linux, redhat

advisories | CVE-2018-1113

SHA-256 | 141b1c66e56dc6dd2a4eddc41a1733eae19b619dadc6d6e659751b6dd1cb76c7

Download | Favorite | View

Quest KACE Systems Management Command Injection

Posted Jun 26, 2018

Authored by Brendan Coles, Leandro Barragan, Guido Leo | Site metasploit.com

This Metasploit module exploits a command injection vulnerability in Quest KACE Systems Management Appliance version 8.0.318 (and possibly prior). The download_agent_installer.php file allows unauthenticated users to execute arbitrary commands as the web server user www. A valid Organization ID is required. The default value is 1. A valid Windows agent version number must also be provided. If file sharing is enabled, the agent versions are available within the \\kace.local\client\agent_provisioning\windows_platform Samba share. Additionally, various agent versions are listed on the KACE website. This Metasploit module has been tested successfully on Quest KACE Systems Management Appliance K1000 version 8.0 (Build 8.0.318).

tags | exploit, web, arbitrary, local, php

systems | windows

advisories | CVE-2018-11138

SHA-256 | 0dbef74980c65246fdf8019f7b0a27a24a0c3431c8e7e457609a060b5a8fdf8d

Download | Favorite | View

Quest KACE System Management Appliance 8.0 (Build 8.0.318) XSS / Traversal / Code Execution / SQL Injection

Posted May 31, 2018

Authored by Core Security Technologies, Leandro Barragan, Guido Leo | Site coresecurity.com

Quest KACE System Management Appliance version 8.0 (Build 8.0.318) suffers from code execution, cross site scripting, path traversal, remote SQL injection, and various other vulnerabilities.

tags | exploit, remote, vulnerability, code execution, xss, sql injection

advisories | CVE-2018-11132, CVE-2018-11133, CVE-2018-11134, CVE-2018-11135, CVE-2018-11136, CVE-2018-11137, CVE-2018-11138, CVE-2018-11139, CVE-2018-11140, CVE-2018-11141, CVE-2018-11142

SHA-256 | fd18c79b0364edc307ae0073788f224ea5fd016ba9223e6018267eb9911d3f41

Download | Favorite | View

vcftools 0.1.15 Out-Of-Bounds Read / Denial Of Service / Buffer Overflow

Posted May 16, 2018

Authored by Webin Security Lab

vcftools version 0.1.15 suffers from out-of-bounds read, denial of service, buffer overflow, and use-after-free vulnerabilities.

tags | advisory, denial of service, overflow, vulnerability

advisories | CVE-2018-11099, CVE-2018-11129, CVE-2018-11130

SHA-256 | 9eefdd1e2925e6f95ad42de0c06c5cd451572d6217a1defb026d0d90bc7f3fd8

Download | Favorite | View