exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 17 of 17 RSS Feed

Files Date: 2017-04-21

Ubuntu Security Notice USN-3260-1
Posted Apr 21, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3260-1 - Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain sensitive information, spoof the addressbar contents or other UI elements, escape the sandbox to read local files, conduct cross-site scripting attacks, cause a denial of service via application crash, or execute arbitrary code. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, local, spoof, xss
systems | linux, ubuntu
advisories | CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5436, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448, CVE-2017-5449, CVE-2017-5451, CVE-2017-5453, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5458, CVE-2017-5459, CVE-2017-5460
SHA-256 | fc547869598b017a6c7221cafb999c384136ffa63756cbd165c0453cc85b6065
Oracle VirtualBox 5.1.18 Guest Additions Double-Free
Posted Apr 21, 2017
Authored by Google Security Research, mjurczyk

A heap double-free vulnerability has been discovered in Oracle VirtualBox version 5.1.18 when Guest Additions (and more specifically shared folders) are enabled in the guest operating system.

tags | exploit
advisories | CVE-2017-3587
SHA-256 | f9a72132a43c0f4dc96388302410d8cba6377cc6b5879b7d58455004d04006fd
WordPress AccessPress Social Icons 1.6.6 SQL Injection
Posted Apr 21, 2017
Authored by DefenseCode, Neven Biruski

WordPress AccessPress Social Icons plugin versions 1.6.6 and below suffer from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 7ce6b848e27ebe9bc1174b66e9697d20e4f5a400b4b4af3a90f7f8e9e95aa985
Starscream 2.0.3 SSL Pinning Bypass
Posted Apr 21, 2017
Authored by Giuliano Galea, Lukas Futera

WebSocket.swift in Starscream versions 2.0.3 and below allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false). An attacker can achieve traffic interception from a man-in-the-middle position, first by resetting the TCP connection between the client and server, and afterwards by injecting an SSL server certificates they control.

tags | advisory, tcp, bypass, info disclosure
advisories | CVE-2017-7192
SHA-256 | 911f854c9a36763caa18a5091f41af4eab6b024c955e6ae37364bb34cf77c512
Exponent CMS 2.4.1 SQL Injection
Posted Apr 21, 2017
Authored by 404 Not Found

Exponent CMS versions 2.4.1 and below suffer from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2017-7991
SHA-256 | b2b3f5f4605b3c70437a96d542184604c06c49b7675da3412cf8e8e513f44142
nt!_SEP_TOKEN_PRIVILEGES Single Write EoP Protection
Posted Apr 21, 2017
Authored by Kyriakos Economou

This is a write up detailing how abusing enabled token privileges through a kernel exploit to gain elevation of privilege won't be enough anymore. From NT kernel version 10.0.15063 they are checked against the privileges present in the token of the calling process so an attacker needs to use two writes.

tags | paper, kernel
SHA-256 | c9bce4e23ea1292a32341faf837c4893b70736ec88069aa0e359dff8ea63548c
Red Hat Security Advisory 2017-1109-01
Posted Apr 21, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1109-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix: An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory.

tags | advisory, java, local
systems | linux, redhat
advisories | CVE-2017-3509, CVE-2017-3511, CVE-2017-3526, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544
SHA-256 | ff72b6e52ac4a8c893ad96530d2d52396b6f91f379caf508b6c3c4b3be7203b2
Red Hat Security Advisory 2017-1108-01
Posted Apr 21, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1108-01 - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix: An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory.

tags | advisory, java, local
systems | linux, redhat
advisories | CVE-2017-3509, CVE-2017-3511, CVE-2017-3526, CVE-2017-3533, CVE-2017-3539, CVE-2017-3544
SHA-256 | 3d64d2e49e80d328a85355344cd3876fce21ddd379c00c469377adfa175df6b7
Ubuntu Security Notice USN-3263-1
Posted Apr 21, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3263-1 - It was discovered that a heap-based buffer overflow existed in the FreeType library. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code.

tags | advisory, remote, denial of service, overflow, arbitrary
systems | linux, ubuntu
advisories | CVE-2016-10328
SHA-256 | 747e1ff3f00647b55dbee7c25069f1800bd121b726e4535c919257812b4cb181
Ubuntu Security Notice USN-3259-1
Posted Apr 21, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3259-1 - It was discovered that the resolver in Bind made incorrect assumptions about ordering when processing responses containing a CNAME or DNAME. An attacker could use this cause a denial of service. Oleg Gorokhov discovered that in some situations, Bind did not properly handle DNS64 queries. An attacker could use this to cause a denial of service. Various other issues were also addressed.

tags | advisory, denial of service
systems | linux, ubuntu
advisories | CVE-2017-3136, CVE-2017-3137, CVE-2017-3138
SHA-256 | e0a0e188df74112ab2a5202c03048a265df98295b15a73fdf2ea5b6597bc2f95
Red Hat Security Advisory 2017-1106-01
Posted Apr 21, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1106-01 - Mozilla Firefox is an open source web browser. This update upgrades Firefox to version 52.1.0 ESR. Security Fix: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.

tags | advisory, web, arbitrary
systems | linux, redhat
advisories | CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5436, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448, CVE-2017-5449, CVE-2017-5451, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5459, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465
SHA-256 | 4885801e989807b32fa2a7c6b4bab8e03699678260864bb71f3a66f21df60342
Ubuntu Security Notice USN-3262-1
Posted Apr 21, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3262-1 - It was discovered that curl incorrectly handled client certificates when resuming a TLS session. A remote attacker could use this to hijack a previously authenticated connection.

tags | advisory, remote
systems | linux, ubuntu
advisories | CVE-2017-7468
SHA-256 | 4d0f9cc1207ab7e0a120544717caa6484e9e7480b27c6d6a66b424de792e25bc
Wells Fargo Poor Password Configurations
Posted Apr 21, 2017
Authored by anonymous

WellsFargo.com password and security management has been identified as being in a weak state of configuration and violation of PCI DSS 3.2 Subsection 8.2.3, 8.2.4. Multiple vulnerabilities result in poor credential management and configuration, as well as flaws in triggering fraud detection. Some vulnerabilities can be paired with each other to increase the risk associated.

tags | advisory, vulnerability
SHA-256 | 9897ca9c7c3fef37c751ef96b01826fa4151765a9919ef86e72d4e6962195fa6
eBay Auction Premium Clone Script 6.42 SQL Injection
Posted Apr 21, 2017
Authored by Bilal Kardadou

eBay Auction Premium Clone Script version 6.42 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | d15360d964854fa4c0bfa270acabafbd26b2a5d73301cf3efd8fe5eb7cb7a181
Thycotic Secret Server Data Decrypter
Posted Apr 21, 2017
Site security-assessment.com

This is a powershell script that decrypts the data stored within a Thycotic Secret Server.

tags | tool
systems | unix
SHA-256 | d429bf0b2808bf60dba4771a11d831563d769d772d9514653991af87457ed807
Oracle Java 64bit DLL Hijacking
Posted Apr 21, 2017
Authored by Florian Bogner

A code injection through DLL sideloading vulnerability exists in 64-bit Oracle Java.

tags | exploit, java
systems | windows
advisories | CVE-2017-3511
SHA-256 | 4f956101cdf5d276c874cea123fd4623f5a037012bdc72feb00042183a276e5d
DAVOSET 1.3.2
Posted Apr 21, 2017
Authored by MustLive

DAVOSET is a tool for committing distributed denial of service attacks using execution on other sites.

Changes: Added support of XXE vulnerability in CyberPower Systems PowerPanel. Also added new services into full list of zombies and removed non-working services from full list of zombies.
tags | tool, denial of service
SHA-256 | add649af08d801bf2b2b02e9536974d3aabaceab3dad73b3c082d0a94f0d12a6
Page 1 of 1
Back1Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close