exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 28 RSS Feed

Files Date: 2018-01-10

HPE iMC dbman RestoreDBase Unauthenticated Remote Command Execution
Posted Jan 10, 2018
Authored by Chris Lyne, sztivi | Site metasploit.com

This Metasploit module exploits a remote command execution vulnerability in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04. The dbman service allows unauthenticated remote users to restore a user-specified database (OpCode 10007), however the database connection username is not sanitized resulting in command injection, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 2810 by default. This Metasploit module has been tested successfully on iMC PLAT v7.2 (E0403) on Windows 7 SP1 (EN).

tags | exploit, remote, arbitrary, tcp
systems | windows
advisories | CVE-2017-5817
SHA-256 | 6e617c9e2dc52b8e3176ccf763528cbf0564f66df4920f7c15aa5b7cd694b5ea
HPE iMC dbman RestartDB Unauthenticated Remote Command Execution
Posted Jan 10, 2018
Authored by Chris Lyne, sztivi | Site metasploit.com

This Metasploit module exploits a remote command execution vulnerability in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04. The dbman service allows unauthenticated remote users to restart a user-specified database instance (OpCode 10008), however the instance ID is not sanitized, allowing execution of arbitrary operating system commands as SYSTEM. This service listens on TCP port 2810 by default. This Metasploit module has been tested successfully on iMC PLAT v7.2 (E0403) on Windows 7 SP1 (EN).

tags | exploit, remote, arbitrary, tcp
systems | windows
advisories | CVE-2017-5816
SHA-256 | 8593e2a11cac9b478374fc96e4123be69ffbd8aafe9adc13437d98414d73a636
Spring Jackson-Databind Default Typing Issue
Posted Jan 10, 2018
Authored by Imre Rad

Proof of concept that exploits the default typing issue in Jackson-databind via Spring application contexts and expressions.

tags | exploit, proof of concept
advisories | CVE-2017-17485, CVE-2017-7525
SHA-256 | 556baf38b3cbd6a00b1977182d2e52222d11bc57c0158fa40ccf472a8568c448
Kernel Live Patch Security Notice LSN-0034-1
Posted Jan 10, 2018
Authored by Benjamin M. Romer

On January 9, fixes for CVE-2017-5754 were released into the Ubuntu Xenial kernel version 4.4.0-108.131. This CVE, also known as "Meltdown," is a security vulnerability caused by flaws in the design of speculative execution hardware in the computer's CPU.

tags | advisory, kernel
systems | linux, ubuntu
advisories | CVE-2017-5754
SHA-256 | d1f83d5380c45fea8b0f7c98adba0bf5365481ee9ac8b2cebf7d26e5186c74c9
VMware Security Advisory 2018-0002.1
Posted Jan 10, 2018
Authored by VMware | Site vmware.com

VMware Security Advisory 2018-0002.1 - VMware ESXi, Workstation and Fusion updates address side-channel analysis due to speculative execution.

tags | advisory
advisories | CVE-2017-5715, CVE-2017-5753
SHA-256 | 963ccf51b4549886833cc22006ffc81cb09d33e8bbc3e81de60d3044de7c9355
VMware Security Advisory 2018-0004
Posted Jan 10, 2018
Authored by VMware | Site vmware.com

VMware Security Advisory 2018-0004 - VMware vSphere, Workstation and Fusion updates add Hypervisor-Assisted Guest remediation for speculative execution issue.

tags | advisory
advisories | CVE-2017-5715
SHA-256 | c6d2e4b063e3ab3f5a8f434842d6b1780e505c1685915b84e2d41b8aa6dce9d1
Debian Security Advisory 4082-1
Posted Jan 10, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4082-1 - Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

tags | advisory, denial of service, kernel, vulnerability
systems | linux, debian
advisories | CVE-2017-1000407, CVE-2017-1000410, CVE-2017-15868, CVE-2017-16538, CVE-2017-16939, CVE-2017-17448, CVE-2017-17449, CVE-2017-17450, CVE-2017-17558, CVE-2017-17741, CVE-2017-17805, CVE-2017-17806, CVE-2017-17807, CVE-2017-5754, CVE-2017-8824
SHA-256 | 347c611935bac535fc1ce2315b4501495b8f7bd67bd16039884f09a909a4602d
Debian Security Advisory 4080-1
Posted Jan 10, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4080-1 - Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language.

tags | advisory, php, vulnerability
systems | linux, debian
advisories | CVE-2017-11144, CVE-2017-11145, CVE-2017-11628, CVE-2017-12932, CVE-2017-12933, CVE-2017-12934, CVE-2017-16642
SHA-256 | fb40631b4e6e2aa36a01a6097b8791637329c2a2a7b66ec5d5560c871d05ec6a
Slackware Security Advisory - irssi Updates
Posted Jan 10, 2018
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New irssi packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

tags | advisory
systems | linux, slackware
advisories | CVE-2018-5205, CVE-2018-5206, CVE-2018-5207, CVE-2018-5208
SHA-256 | 4489cd71a5ef8912e23b5f4d1c1772857ab325f60226dc1f82a59f9efe07e4d0
Ubuntu Security Notice USN-3524-1
Posted Jan 10, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3524-1 - Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory.

tags | advisory, kernel, local
systems | linux, ubuntu
advisories | CVE-2017-5754
SHA-256 | c8bb4a82294102baa9e7f69f64d2d2878ce4d9cc96d24be8c1049ae3616180f4
Ubuntu Security Notice USN-3522-2
Posted Jan 10, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3522-2 - USN-3522-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory. Various other issues were also addressed.

tags | advisory, kernel, local, vulnerability
systems | linux, ubuntu
advisories | CVE-2017-5754
SHA-256 | 3e930e1f5dff43194405e5579a9823306e54589d76fe6adf09696898ed22a655
Ubuntu Security Notice USN-3522-1
Posted Jan 10, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3522-1 - Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory.

tags | advisory, kernel, local
systems | linux, ubuntu
advisories | CVE-2017-5754
SHA-256 | 08ae6485c712ce5c920c54c20ceb6ff954aceba2445bce96579831fef548df84
Ubuntu Security Notice USN-3523-1
Posted Jan 10, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3523-1 - Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory. Jann Horn discovered that the Berkeley Packet Filter implementation in the Linux kernel did not properly check the relationship between pointer values and the BPF stack. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, kernel, local
systems | linux, ubuntu
advisories | CVE-2017-16995, CVE-2017-17862, CVE-2017-17863, CVE-2017-17864, CVE-2017-5754
SHA-256 | 5e21912d20ede254be2f46410d61a48a034c988bdc1be837146967e4fe2ff191
Debian Security Advisory 4081-1
Posted Jan 10, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4081-1 - Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language.

tags | advisory, php, vulnerability
systems | linux, debian
advisories | CVE-2017-11142, CVE-2017-11143, CVE-2017-11144, CVE-2017-11145, CVE-2017-11628, CVE-2017-12933, CVE-2017-16642
SHA-256 | f7aae35ae4ec77a819fbff5ac55f53d91ca4cdc6887bdb1c9c1f9c3f7ea1b7e8
Microsoft Windows Local XPS Print Spooler Sandbox Escape
Posted Jan 10, 2018
Authored by James Forshaw, Google Security Research

The Microsoft Windows local print spooler can be abused to create an arbitrary file from a low privilege application including one in an AC as well as a typical Edge LPAC CP leading to elevation of privilege.

tags | exploit, arbitrary, local
systems | windows
SHA-256 | 5c56ace40b07b3eea1f0414716862aee14ba5600ee84beb8a7da67c6abb0c94b
Microsoft Windows Kernel ATMFD.DLL NamedEscape 0x250D Pool Corruption
Posted Jan 10, 2018
Authored by Google Security Research, mjurczyk

The Microsoft Windows OpenType ATMFD.DLL kernel-mode font driver has an undocumented "escape" interface, handled by the standard DrvEscape and DrvFontManagement functions implemented by the module. The interface is very similar to Buffered IOCTL in nature, and handles 13 different operation codes in the numerical range of 0x2502 to 0x2514. It is accessible to user-mode applications through an exported (but not documented) gdi32!NamedEscape function, which internally invokes the NtGdiExtEscape syscall.

tags | advisory, kernel
systems | windows
advisories | CVE-2018-0788
SHA-256 | bb274850f13f39d2cc7b83f33319ed2f50d1c874d081fd6fe6774c05fbaf68fb
Microsoft Windows Kernel ATMFD.DLL Out-Of-Bounds Read
Posted Jan 10, 2018
Authored by Google Security Research, mjurczyk

The Microsoft Windows OpenType ATMFD.DLL kernel-mode driver lacks any sort of sanitization of various 32-bit offsets found in .MMM files (Multiple Master Metrics), and instead uses them blindly while loading Type 1 Multiple-Master fonts in the system.

tags | advisory, kernel
systems | windows
advisories | CVE-2018-0754
SHA-256 | b8102ba5cbc41970fedaf8cb7c662e036805d3aff1751f055103ddb03a105367
Microsoft Windows Kernel nt!PiUEventHandleGetEven Stack Memory Disclosure
Posted Jan 10, 2018
Authored by Google Security Research, mjurczyk

The Microsoft Windows kernel suffers from a stack memory disclosure from nt!RawMountVolume via nt!PiUEventHandleGetEvent (\Device\DeviceApi\CMNotify device).

tags | advisory, kernel
systems | windows
advisories | CVE-2018-0747
SHA-256 | 4245759a610e4875033a8cfc4ff41296198e721a838158cc5a4f29dd1838640c
Microsoft Edge Chakra JIT Escape Analysis Bug
Posted Jan 10, 2018
Authored by Google Security Research, lokihardt

Microsoft Edge Chakra fails to detect if "tmp" escapes the scope, allocates it to the stack. This may lead to dereference uninitialized stack values.

tags | exploit
advisories | CVE-2017-11918
SHA-256 | e75c0b7061c30013e71afb6bd97779067f7723b0f2e1cf092d0c9d4b92c2d136
Microsoft Windows Kernel nt!NtQuerySystemInformation Memory Disclosure
Posted Jan 10, 2018
Authored by Google Security Research, mjurczyk

The Microsoft Windows kernel pool suffers from a memory disclosure in nt!NtQuerySystemInformation (information class 138, QueryMemoryTopologyInformation).

tags | exploit, kernel
systems | windows
advisories | CVE-2018-0746
SHA-256 | e572e268023cabc683d71d1229389e3c95052ecd8ab0d445337f24230815954a
Microsoft Windows Kernel nt!NtQueryInformationProcess Stack Memory Disclosure
Posted Jan 10, 2018
Authored by Google Security Research, mjurczyk

The Microsoft Windows kernel suffers from a stack memory disclosure in nt!NtQueryInformationProcess (information class 76, QueryProcessEnergyValues).

tags | exploit, kernel
systems | windows
advisories | CVE-2018-0745
SHA-256 | bfd46a1d8d67416403423e1b59913b8c6cd67fe31a752a390b97a6aac06a5beb
Android ashmem Race Condition
Posted Jan 10, 2018
Authored by Google Security Research, laginimaineb

The Android MemoryIntArray class allows processes to share an in-memory array of integers backed by an "ashmem" file descriptor. As the class implements the Parcelable interface, it can be inserted into a Parcel, and optionally placed in a Bundle and transferred via binder to remote processes.

tags | exploit, remote
advisories | CVE-2017-13216
SHA-256 | 029f917e2e536de18d04761028191f4815fb7c9f5d6d53318a48a27ff5c347bb
Microsoft Edge Chakra JIT asm.js Out-Of-Bounds Read
Posted Jan 10, 2018
Authored by Google Security Research, lokihardt

Microsoft Edge Chakra JIT suffers from an out-of-bounds read in asm.js.

tags | exploit
advisories | CVE-2017-11911
SHA-256 | 3dbadffd487c282938dfeef00382193f9d732adf03adf862f22f984c574f5cc1
Microsoft Edge Chakra JIT BackwardPass::RemoveEmptyLoopAfterMemOp Failed Insert
Posted Jan 10, 2018
Authored by Google Security Research, lokihardt

Microsoft Edge Chakra JIT has an issue where BackwardPass::RemoveEmptyLoopAfterMemOp does not insert branches.

tags | exploit
advisories | CVE-2017-11909
SHA-256 | 60c50e5770fe9cf8d0a6b1b9db3bfee2421dd1354b480605f75a9f93bb16ffe8
Microsoft Edge Chakra JIT Op_MaxInAnArray / Op_MinInAnArray Misuse
Posted Jan 10, 2018
Authored by Google Security Research, lokihardt

Microsoft Edge Chakra JIT has an issue where Op_MaxInAnArray and Op_MinInAnArray Misuse can explicitly call user defined JavaScript functions.

tags | exploit, javascript
advisories | CVE-2017-11893
SHA-256 | 283f5a24fbb70e666e7313c38982967327884e5a4d3566411fa14556feb83259
Page 1 of 2
Back12Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close