ignore security and it'll go away
Showing 1 - 21 of 21 RSS Feed

Files Date: 2014-02-07

Pandora FMS 5.0RC1 Remote Code Execution
Posted Feb 7, 2014
Authored by xistence | Site metasploit.com

This Metasploit module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower. It will leverage an unauthenticated command injection in the Anyterm service on port 8023. Commands are executed as the user "pandora". In Pandora FMS 4.1 and 5.0RC1 the user "artica" is not assigned a password by default, which makes it possible to su to this user from the "pandora" user. The "artica" user has access to sudo without a password, which makes it possible to escalate privileges to root. However, Pandora FMS 4.0 and lower force a password for the "artica" user during installation.

tags | exploit, root
MD5 | 35d7dfee04901de86a3c3aaf7fa196bf
Android Browser / WebView addJavascriptInterface Code Execution
Posted Feb 7, 2014
Authored by jduck, joev | Site metasploit.com

This Metasploit module exploits a privilege escalation issue in Android versions prior 4.2's WebView component that arises when untrusted Javascript code is executed by a WebView that has one or more Interfaces added to it. The untrusted Javascript code can call into the Java Reflection APIs exposed by the Interface and execute arbitrary commands. Some distributions of the Android Browser app have an addJavascriptInterface call tacked on, and thus are vulnerable to RCE. The Browser app in the Google APIs 4.1.2 release of Android is known to be vulnerable. A secondary attack vector involves the WebViews embedded inside a large number of Android applications. Ad integrations are perhaps the worst offender here. If you can MITM the WebView's HTTP connection, or if you can get a persistent XSS into the page displayed in the WebView, then you can inject the html/js served by this module and get a shell. Note: Adding a .js to the URL will return plain javascript (no HTML markup).

tags | exploit, web, arbitrary, shell, javascript
MD5 | b1f0b039cf8acfc93ca30fa9147f1966
Debian Security Advisory 2852-1
Posted Feb 7, 2014
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2852-1 - Yves Younan and Ryan Pentney discovered that libgadu, a library for accessing the Gadu-Gadu instant messaging service, contained an integer overflow leading to a buffer overflow. Attackers which impersonate the server could crash clients and potentially execute arbitrary code.

tags | advisory, overflow, arbitrary
systems | linux, debian
advisories | CVE-2013-6487
MD5 | de7688537eb88d4ac6cfd46ef74ffc7e
Gentoo Linux Security Advisory 201402-08
Posted Feb 7, 2014
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201402-8 - Multiple vulnerabilities have been found in stunnel, the worst of which may cause a Denial of Service condition. Versions less than 4.56-r1 are affected.

tags | advisory, denial of service, vulnerability
systems | linux, gentoo
advisories | CVE-2012-2686, CVE-2013-0166, CVE-2013-0169, CVE-2013-1762
MD5 | 36b86d02329d940a3e684bc002db9528
Ubuntu Security Notice USN-2100-1
Posted Feb 7, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2100-1 - Thijs Alkemade and Robert Vehse discovered that Pidgin incorrectly handled the Yahoo! protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. Jaime Breva Ribes discovered that Pidgin incorrectly handled the XMPP protocol. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. It was discovered that Pidgin incorrectly handled long URLs. A remote attacker could use this issue to cause Pidgin to crash, resulting in a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service, protocol
systems | linux, ubuntu
advisories | CVE-2012-6152, CVE-2013-6477, CVE-2013-6478, CVE-2013-6479, CVE-2013-6481, CVE-2013-6482, CVE-2013-6483, CVE-2013-6484, CVE-2013-6485, CVE-2013-6487, CVE-2013-6489, CVE-2013-6490, CVE-2014-0020, CVE-2012-6152, CVE-2013-6477, CVE-2013-6478, CVE-2013-6479, CVE-2013-6481, CVE-2013-6482, CVE-2013-6483, CVE-2013-6484, CVE-2013-6485, CVE-2013-6487, CVE-2013-6489, CVE-2013-6490, CVE-2014-0020
MD5 | 9df7580fd36f5010231aefa7a195e233
Apache Commons FileUpload / Apache Tomcat Denial Of Service
Posted Feb 7, 2014
Authored by Mark Thomas | Site tomcat.apache.org

It is possible to craft a malformed Content-Type header for a multipart request that causes Apache Commons FileUpload to enter an infinite loop. A malicious user could, therefore, craft a malformed request that triggered a denial of service. Affected include Apache Tomcat versions 7.0.0 through 7.0.50, 8.0.0-RC1 through 8.0.1, and Apache Commons FileUpload versions 1.0 through 1.3.

tags | advisory, denial of service
advisories | CVE-2014-0050
MD5 | 74c15a9ee9199cea345a890efda3be94
AlienVault OSSIM 4.3 SQL Injection
Posted Feb 7, 2014
Authored by A. Smith

AlienVault OSSIM version 4.3 suffers from a remote SQL injection vulnerability.

tags | advisory, remote, sql injection
MD5 | 092134ad4e8f10c234bc728050a9209d
IPSet List 3.1
Posted Feb 7, 2014
Authored by AllKind | Site sourceforge.net

ipset_list is a wrapper script for listing sets of the netfilter ipset program. It allows you to match and display sets, headers, and elements in various ways. Optionally, the output can be colorized.

Changes: The new option -Hi has been added. It allows arithmetic comparison on values of the sets headers Header flag i.e. hashsize, timeout. The options to exclude set members are no longer mutually exclusive to those that match members. Some corrections to the command synopsis and the bash completion code have also been done.
tags | tool, firewall
systems | linux, unix
MD5 | 90e6339cfd6c1751cec406c6975c9a32
IPSet Bash Completion 2.3.1
Posted Feb 7, 2014
Authored by AllKind | Site sourceforge.net

ipset-bash-completion is programmable completion code for the bash shell, to support the ipset program (netfilter.org). It allows you to interactively retrieve and complete options, commands, set names, types, and members.

Changes: This release fixes two small bugs related to option completion.
tags | tool, shell, firewall, bash
systems | linux, unix
MD5 | 38574c6c2d178658f924c4b640e618ae
Apache Wicket 1.4.22 / 1.5.10 / 6.7.0 Information Disclosure
Posted Feb 7, 2014
Site wicket.apache.org

Apache Wicket versions 1.4.22, 1.5.10, and 6.7.0 suffer from an information disclosure vulnerability.

tags | advisory, info disclosure
advisories | CVE-2013-2055
MD5 | 403bf4c459ccbfe93492154450ff3d5e
German Telekom SQL Injection
Posted Feb 7, 2014
Authored by Ibrahim El-Sayed | Site vulnerability-lab.com

German Telekom suffered from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 849230204ae117cd8f5c18cd409a757d
German Telekom Arbitrary File Upload
Posted Feb 7, 2014
Authored by Ibrahim El-Sayed | Site vulnerability-lab.com

German Telekom suffered from a remote shell upload vulnerability.

tags | exploit, remote, shell
MD5 | 8e2c17024296b170733151eb3fef0193
German Telekom Code Execution
Posted Feb 7, 2014
Authored by Ibrahim El-Sayed | Site vulnerability-lab.com

German Telekom suffered from a code execution vulnerability.

tags | exploit, code execution
MD5 | a993f0c6673a5d20db7d8ba53f60a41f
Atmail WebMail 7.0.2 Cross Site Scripting
Posted Feb 7, 2014
Authored by Vicente Aguilera Diaz

Atmail WebMail version 7.0.2 suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
advisories | CVE-2013-6229
MD5 | 54a7177534ee6e24474f3e848f3ff4fb
Drupal Modal Frame API 6.x Cross Site Scripting
Posted Feb 7, 2014
Authored by Erich Beyrent | Site drupal.org

Drupal Modal Frame API third party module version 6.x suffers from a cross site scripting vulnerability.

tags | advisory, xss
MD5 | bfa6045494d84930639c3a85ce3ee6ac
Drupal Push Notifications 7.x Information Disclosure
Posted Feb 7, 2014
Authored by Graham Bates | Site drupal.org

Drupal Push Notifications third party module version 7.x suffers from an information disclosure vulnerability.

tags | advisory, info disclosure
MD5 | 11c8e0af5744977cda4e855093211728
Asseco SEE iBank FX Client 2.0.93 Privilege Escalation
Posted Feb 7, 2014
Authored by LiquidWorm | Site zeroscience.mk

Asseco SEE iBank FX client versions 2.0.9.3 and below suffer from a local privilege escalation vulnerability.

tags | exploit, local
MD5 | 00db32ec4d40fb3cc2ec92a196a4deac
osCommerce 2.x SQL Injection
Posted Feb 7, 2014
Authored by Ahmed Aboul-Ela

osCommerce version 2.x suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | eba790875bada38c330c5d13f0f19e1e
Projoom NovaSFH 3.0.3 Remote Code Execution
Posted Feb 7, 2014
Authored by Yuri Kramarz | Site portcullis-security.com

The PHP executable in Projoom NovaSFH plugin version 3.0.3 which is responsible for handling file upload functionality allows arbitrary files to be uploaded to any directory specified by the attackers as the file upload function does not does not verify file type or origin when processing the request.

tags | advisory, arbitrary, php, file upload
advisories | CVE-2014-1214
MD5 | 05c3e78c9abf0e252d684ffbf4004a2f
WordPress Dandelion Theme Shell Upload
Posted Feb 7, 2014
Authored by TheBlackMonster

WordPress Dandelion Theme suffers from a remote shell upload vulnerability.

tags | exploit, remote, shell
advisories | OSVDB-99043
MD5 | 68b64dea011854ec6928793802d2fc56
Joomla 3.2.1 SQL Injection
Posted Feb 7, 2014
Authored by killall-9

Joomla version 3.2.1 suffers from a SQL injection vulnerability.

tags | exploit, sql injection
MD5 | fca3fbf3978df56b3dc53a4f656186b2
Page 1 of 1
Back1Next

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    15 Files
  • 19
    Oct 19th
    10 Files
  • 20
    Oct 20th
    7 Files
  • 21
    Oct 21st
    4 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close