what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 17 of 17 RSS Feed

Files Date: 2016-06-24

GRR 3.1.0.2
Posted Jun 24, 2016
Authored by Andreas Moser, Mikhail Bushkov, Ben Galehouse, Milosz Lakomy | Site github.com

GRR Rapid Response is an incident response framework focused on remote live forensics. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely. GRR consists of 2 parts: client and server. GRR client is deployed on systems that one might want to investigate. On every such system, once deployed, GRR client periodically polls GRR frontend servers for work. "Work" means running a specific action: downloading file, listing a directory, etc. GRR server infrastructure consists of several components (frontends, workers, UI servers) and provides web-based graphical user interface and an API endpoint that allows analysts to schedule actions on clients and view and process collected data.

Changes: Added Chrome desktop notifications. Added ability to create a hunt from a flow. Various other updates.
tags | tool, remote, web, forensics
systems | unix
SHA-256 | cebdc54c08fbf73c1dc36e7ad084e8d5637c9e8d3bc4821717eb8182601860b2
SugarCRM 6.5.23 SugarRestSerialize.php PHP Object Injection
Posted Jun 24, 2016
Authored by EgiX

SugarCRM versions 6.5.23 and below suffer from a PHP object injection vulnerability.

tags | advisory, php
SHA-256 | 1a98da7144e660a3accb44aab022cd43453f7c51263930ef13a00ccd4a03cb51
SugarCRM 6.5.18 fopen() Command Injection / XSS / SSRF
Posted Jun 24, 2016
Authored by EgiX

SugarCRM versions 6.5.18 and below suffer from a MySugar::addDashlet insecure fopen() usage that can lead to command injection, cross site scripting, and server-side request forgery exploitation.

tags | exploit, xss
SHA-256 | b5ea2947c8c691e63cd8b15a2ad9c1ce3e6371ed8f9cad785fad1655ff9e56d0
SugarCRM 6.5.18 PHP Code Injection
Posted Jun 24, 2016
Authored by EgiX

SugarCRM versions 6.5.18 and below suffer from two PHP code injection vulnerabilities.

tags | exploit, php, vulnerability
SHA-256 | dd7c80c6120e1805c1954e5087e5f215c67a081881bc8f20fcaa86bfed40b75e
SugarCRM 6.5.18 Missing Authorization
Posted Jun 24, 2016
Authored by EgiX

SugarCRM versions 6.5.18 and below suffer from a missing authorization check vulnerability.

tags | exploit
SHA-256 | b0d6c09a780b84f51c2d8a829a8cad6ddf0b80bf8cd8641bb49a73cc3e3ff170
SugarCRM 6.5.18 SAML Authentication XML External Entity
Posted Jun 24, 2016
Authored by EgiX

SugarCRM versions 6.5.18 CE and below suffer from a SAML authentication XML external entity vulnerability.

tags | advisory, xxe
SHA-256 | d8bf3667bba05f07cd81eeb7dfd0728907f68ad4f68d3142091238587292b06e
Mandos Encrypted File System Unattended Reboot Utility 1.7.10
Posted Jun 24, 2016
Authored by Teddy | Site fukt.bsnet.se

The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.

Changes: Various updates.
tags | tool, remote, root
systems | linux, unix
SHA-256 | 86e418de2aac43020606f2e92da75151e43c7c2706cb9491408f764cbd099af2
Red Hat Security Advisory 2016-1301-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1301-01 - The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. The following packages have been upgraded to a newer upstream version: kernel-rt.

tags | advisory, kernel
systems | linux, redhat
advisories | CVE-2015-8767, CVE-2016-3707, CVE-2016-4565
SHA-256 | a823740bd10edd796c58b8994ad6daecb97f95cae7384700dd3afa603f8a79a3
Red Hat Security Advisory 2016-1296-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1296-01 - OCaml is a high-level, strongly-typed, functional, and object-oriented programming language from the ML family of languages. The ocaml packages contain two batch compilers, an interactive top level system, parsing tools, a replay debugger, a documentation generator, and a comprehensive library. Security Fix: OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes size arguments to internal memmove calls to be sign-extended from 32- to 64-bits before being passed to the memmove function. This leads to arguments between 2GiB and 4GiB being interpreted as larger than they are, causing a buffer overflow. Further, arguments between 4GiB and 6GiB are interpreted as 4GiB smaller than they should be, causing a possible information leak.

tags | advisory, overflow
systems | linux, redhat
advisories | CVE-2015-8869
SHA-256 | 65a6a453296687f548fd82a2111f0e0bf5d24226b44b64a220454e43448dd1cc
Red Hat Security Advisory 2016-1277-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1277-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. These updated kernel packages include several security issues and numerous bug fixes, some of which you can see below. Space precludes documenting all of these bug fixes in this advisory.

tags | advisory, kernel
systems | linux, redhat
advisories | CVE-2015-8767, CVE-2016-4565
SHA-256 | 10fb51383d7fc7d48506cede67c2760a1099fe9515a561b75ec00b53e62af238
Red Hat Security Advisory 2016-1333-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1333-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on Wildfly. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 7.0. Security Fix: It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

tags | advisory, java, spoof, protocol, info disclosure
systems | linux, redhat
advisories | CVE-2016-2141
SHA-256 | c09dd3666c7a73222ab648af437feab92c57336cf956ab1e4fce57b7330e47de
Red Hat Security Advisory 2016-1331-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1331-01 - Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 6.4. Security Fix: It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

tags | advisory, java, spoof, protocol, info disclosure
systems | linux, redhat
advisories | CVE-2016-2141
SHA-256 | 5be0820af696aa2a268452c7cb12e9918cf60b6dbaaa9e3eabe78bcba849c38c
Red Hat Security Advisory 2016-1329-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1329-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 5.2. Security Fix: It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

tags | advisory, java, spoof, protocol, info disclosure
systems | linux, redhat
advisories | CVE-2016-2141
SHA-256 | cbe5a6f3c25be1d44c8a6c37d72e9e00d69f1ebab57ebe7a864da31a0019d894
Red Hat Security Advisory 2016-1332-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1332-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on Wildfly. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 7.0. Security Fix: It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

tags | advisory, java, spoof, protocol, info disclosure
systems | linux, redhat
advisories | CVE-2016-2141
SHA-256 | 0b70cff2d3ed8610586553763eefcb42254dcb7ea35857a452af437770062313
Red Hat Security Advisory 2016-1330-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1330-01 - Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 6.4. Security Fix: It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

tags | advisory, java, spoof, protocol, info disclosure
systems | linux, redhat
advisories | CVE-2016-2141
SHA-256 | 20714f9ab297fe4c3aba11ec350c579ba01411bef55c8fc002958030913a6a60
Red Hat Security Advisory 2016-1328-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1328-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss Hibernate and JBoss Seam. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Enterprise Application Platform 5.2. Security Fix: It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

tags | advisory, java, spoof, protocol, info disclosure
systems | linux, redhat
advisories | CVE-2016-2141
SHA-256 | b321f1b893ea8425ae2c8704d6bb5ac2e38ce33ed0aba504fd5def3d7b6cde15
Red Hat Security Advisory 2016-1334-01
Posted Jun 24, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-1334-01 - Red Hat JBoss Data Grid is a distributed in-memory data grid, based on Infinispan. This asynchronous patch is a security update for JGroups package in Red Hat JBoss Data Grid 6.6. Security Fix: It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

tags | advisory, spoof, protocol, info disclosure
systems | linux, redhat
advisories | CVE-2016-2141
SHA-256 | 2316b5764bfc5bd59d8d306c5d123284da962f5f13f6cd12804ceea6eae3b48f
Page 1 of 1
Back1Next

File Archive:

December 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    0 Files
  • 2
    Dec 2nd
    41 Files
  • 3
    Dec 3rd
    25 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close