exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 44 RSS Feed

Files Date: 2018-01-11

Microsoft Windows SMB Server Mount Point Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the SMB server drivers (srv.sys and srv2.sys) do not check the destination of a NTFS mount point when manually handling a reparse operation leading to being able to locally open an arbitrary device via an SMB client which can result in privilege escalation.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2018-0749
SHA-256 | 18c5e8b69488f509de251342dd3e47d18e57b85a83a80396d794f1f67e9b08c0
Microsoft Windows NtImpersonateAnonymousToken LPAC To Non-LPAC Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, when impersonating the anonymous token in an LPAC the WIN://NOAPPALLPKG security attribute is ignored leading to impersonating a non-LPAC token leading to privilege escalation.

tags | exploit
systems | windows
advisories | CVE-2018-0752
SHA-256 | ea9947419e769dd9e18edeb304390de5704daee25ebd8b4d342bdc9bfc87ebea
Microsoft Windows NtImpersonateAnonymousToken AC To Non-AC Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the check for an AC token when impersonating the anonymous token does not check impersonation token's security level leading to impersonating a non-AC anonymous token leading to privilege escalation.

tags | exploit
systems | windows
advisories | CVE-2018-0751
SHA-256 | 25a65ee6cfd0f1fa9da6eec73313f59622aaad24e48dd564fccff23fab03b387
Microsoft Windows NTFS Owner/Mandatory Label Privilege Bypass
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

When creating a new file on an NTFS drive it's possible to circumvent security checks for setting an arbitrary owner and mandatory label leading to a non-admin user setting those parts of the security descriptor with non-standard values which could result in further attacks resulting privilege escalation.

tags | exploit, arbitrary
advisories | CVE-2018-0748
SHA-256 | 9f879ee71e885a24959ae7270d898aeb86356fd6f7338f21bc7cc2accad3c7a8
Debian Security Advisory 4083-1
Posted Jan 11, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4083-1 - Stephan Zeisberg discovered that poco, a collection of open source C++ class libraries, did not correctly validate file paths in ZIP archives. An attacker could leverage this flaw to create or overwrite arbitrary files.

tags | advisory, arbitrary
systems | linux, debian
advisories | CVE-2017-1000472
SHA-256 | 17161b54707cb0c6dff7a79893bbc4d50aa757d637c78da205274c22de089bf3
VMware Security Advisory 2018-0005
Posted Jan 11, 2018
Authored by VMware | Site vmware.com

VMware Security Advisory 2018-0005 - VMware Workstation, and Fusion updates resolve use-after-free and integer-overflow vulnerabilities.

tags | advisory, overflow, vulnerability
advisories | CVE-2017-4949, CVE-2017-4950
SHA-256 | c55eb4b61afe1e1236e68c13ef43af9c894b17642cfeb6b30500ac46f62ecd75
VMware Security Advisory 2018-0004.1
Posted Jan 11, 2018
Authored by VMware | Site vmware.com

VMware Security Advisory 2018-0004.1 - VMware vSphere, Workstation and Fusion updates add Hypervisor- Assisted Guest remediation for speculative execution issue.

tags | advisory
advisories | CVE-2017-5715
SHA-256 | 3c7f5251b5e0644abc3bb94af6093929973933a6eaf75dd6d6a0dd89c7e5de52
Linux/ARM (Raspberry Pi) Bind Shell Shellcode
Posted Jan 11, 2018
Authored by Azeria

112 bytes small Linux/ARM (Raspberry Pi) null-free shellcode that binds a shell to 0.0.0.0:4444/TCP.

tags | shell, tcp, shellcode
systems | linux
SHA-256 | d5f25826776a31e42e29e868cae7d248c9190fbbbe3abafab9a10ef3ba422041
LabF nfsAxe 3.7 FTP Client Stack Buffer Overflow
Posted Jan 11, 2018
Authored by Daniel Teixeira, Tulpa | Site metasploit.com

This Metasploit module exploits a buffer overflow in the LabF nfsAxe 3.7 FTP Client allowing remote code execution.

tags | exploit, remote, overflow, code execution
SHA-256 | 241e34b13eab130be620a23f461dd59501c6111482d96e813435aadcb049ca4b
Samsung SRN-1670D Web Viewer 1.0.0.193 Arbitrary File Read / Upload
Posted Jan 11, 2018
Authored by Omar Mezrag, Algeria, Realistic Security | Site metasploit.com

This Metasploit module exploits an unrestricted file upload vulnerability in Web Viewer 1.0.0.193 on Samsung SRN-1670D devices. The network_ssl_upload.php file allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the file in the upload/ directory. To authenticate for this attack, one can obtain web-interface credentials in cleartext by leveraging the existing local file read vulnerability referenced by CVE-2015-8279, which allows remote attackers to read the web interface credentials by sending a request to: cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.

tags | exploit, remote, web, arbitrary, local, root, php, file upload
advisories | CVE-2015-8279, CVE-2017-16524
SHA-256 | 01dd3eafd05e3df998f5fcb41b54bc9db77b1c53fd0d923b9b36d3070206c261
phpCollab 2.5.1 Unauthenticated File Upload
Posted Jan 11, 2018
Authored by Nicolas Serra, Nick Marcoccio | Site metasploit.com

This Metasploit module exploits a file upload vulnerability in phpCollab version 2.5.1 which could be abused to allow unauthenticated users to execute arbitrary code under the context of the web server user. The exploit has been tested on Ubuntu 16.04.3 64-bit

tags | exploit, web, arbitrary, file upload
systems | linux, ubuntu
advisories | CVE-2017-6090
SHA-256 | 45d36cc04840bd87751a09ee05da85fea9974f7260a94093b39bf929c1b8981e
Red Hat Security Advisory 2018-0081-01
Posted Jan 11, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-0081-01 - The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 28.0.0.137. Security Fix: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletins listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to disclose sensitive information or modify its settings when the victim loaded a page containing the malicious SWF content.

tags | advisory, web, vulnerability
systems | linux, redhat
advisories | CVE-2017-11305, CVE-2018-4871
SHA-256 | 28fd1431bf0cb04ae2f8f3c9ff3c043d8a73c829c878f37a14b049198351e0c3
Ubuntu Security Notice USN-3522-4
Posted Jan 11, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3522-4 - USN-3522-2 fixed a vulnerability in the Linux Hardware Enablement kernel for Ubuntu 14.04 LTS to address Meltdown. Unfortunately, that update introduced a regression where a few systems failed to boot successfully. This update fixes the problem. Various other issues were also addressed.

tags | advisory, kernel
systems | linux, ubuntu
advisories | CVE-2017-5754
SHA-256 | 6862be761b1dcb30b91a643bb46e4863f5340befc61f688864daa1afed24e505
WordPress Testimonial Slider 1.2.4 SQL Injection
Posted Jan 11, 2018
Authored by DefenseCode, Neven Biruski

WordPress Testimonial Slider plugin versions 1.2.4 and below suffer from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 4843ea7190a8b03ec20a9232c6f5a6ded3adba6e253edb278b67f49e681f02b0
WordPress Smooth Slider 2.8.6 SQL Injection
Posted Jan 11, 2018
Authored by DefenseCode, Neven Biruski

WordPress Smooth Slider plugin versions 2.8.6 and below suffer from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 969899dce42308e6793f299ffa4d732c1287d84bb8b4576223cafa7d5fed6dce
WordPress Dbox 3D Slider Lite 1.2.2 SQL Injection
Posted Jan 11, 2018
Authored by DefenseCode, Neven Biruski

WordPress Dbox 3D Slide Lite plugin versions 1.2.2 and below suffer from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 5528cd5d06c970cf9130914fc542c9f448c79f182518089b7000c271a6fad1db
WordPress MQ ReLinks 1.8 XSS / Open Redirection
Posted Jan 11, 2018
Authored by Ricardo Sanchez

WordPress MQ ReLinks plugin version 1.8 suffers from cross site scripting and open redirection vulnerabilities.

tags | exploit, vulnerability, xss
SHA-256 | fc518af6564abf5f1e7617a5d60b9fc3cd71b5891344028bf3c213f96ffdf7bb
Joomla! Easydiscuss Cross Site Scripting
Posted Jan 11, 2018
Authored by Mattia Furlani

Joomla! Easydiscuss component versions prior to 4.0.21 suffer from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2018-5263
SHA-256 | c960d37c89bf05306a37c2cf452544e7ec2f90ce0081a3636a471ab6210d61a5
Jungo Windriver 12.5.1 Privilege Escalation
Posted Jan 11, 2018
Authored by Fidus InfoSecurity

Jungo Windriver version 12.5.1 suffers from a privilege escalation vulnerability.

tags | exploit
advisories | CVE-2018-5189
SHA-256 | fc734e85e062abc03c9384d3cfac0e77d5dfab9348f5c5d7d19be424892313b4
Ubuntu Security Notice USN-3522-3
Posted Jan 11, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3522-3 - USN-3522-1 fixed a vulnerability in the Linux kernel to address Meltdown. Unfortunately, that update introduced a regression where a few systems failed to boot successfully. This update fixes the problem. Various other issues were also addressed.

tags | advisory, kernel
systems | linux, ubuntu
advisories | CVE-2017-5754
SHA-256 | 3d888a24e68dcf009147e529cc3b6ec39359c7c07037e2215fe1c2bff50e9247
TP-Link Remote Command Injection
Posted Jan 11, 2018
Authored by chunibalon, puzzor

Many TP-Link products suffer from multiple authenticated remote command injection vulnerabilities.

tags | exploit, remote, vulnerability
advisories | CVE-2017-15613, CVE-2017-15614, CVE-2017-15615, CVE-2017-15616, CVE-2017-15617, CVE-2017-15618, CVE-2017-15619, CVE-2017-15620, CVE-2017-15621, CVE-2017-15622, CVE-2017-15623, CVE-2017-15624, CVE-2017-15625, CVE-2017-15626, CVE-2017-15627, CVE-2017-15628, CVE-2017-15629, CVE-2017-15630, CVE-2017-15631, CVE-2017-15632, CVE-2017-15633, CVE-2017-15634, CVE-2017-15635, CVE-2017-15636, CVE-2017-15637
SHA-256 | 2a4a4012702f3e672405556f143a7f5f9ab5511b05a1ecf69704a91de84485dc
Ubuntu Security Notice USN-3528-1
Posted Jan 11, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3528-1 - It was discovered that Ruby incorrectly handled certain terminal emulator escape sequences. An attacker could use this to execute arbitrary code via a crafted user name. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. It was discovered that Ruby incorrectly handled certain strings. An attacker could use this to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, ruby
systems | linux, ubuntu
advisories | CVE-2017-10784, CVE-2017-14033, CVE-2017-14064, CVE-2017-17790
SHA-256 | 88d323ec80f067827ae8c99ddded9ca9db51fec211fa2406a877e03ffa4a9ecb
Ubuntu Security Notice USN-3527-1
Posted Jan 11, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3527-1 - Joseph Bisch discovered that Irssi incorrectly handled incomplete escape codes. If a user were tricked into using malformed commands or opening malformed files, an attacker could use this issue to cause Irssi to crash, resulting in a denial of service. Joseph Bisch discovered that Irssi incorrectly handled settings the channel topic without specifying a sender. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. Various other issues were also addressed.

tags | advisory, denial of service
systems | linux, ubuntu
advisories | CVE-2018-5205, CVE-2018-5206, CVE-2018-5207, CVE-2018-5208
SHA-256 | b2e9a71756d5b11b35c7c174fb15cae2d4c4ff27170f2e36a05fde4350c800a0
Ubuntu Security Notice USN-3523-3
Posted Jan 11, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3523-3 - Jann Horn discovered that the Berkeley Packet Filter implementation in the Linux kernel did not properly check the relationship between pointer values and the BPF stack. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Jann Horn discovered that the Berkeley Packet Filter implementation in the Linux kernel improperly performed sign extension in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, denial of service, arbitrary, kernel, local
systems | linux, ubuntu
advisories | CVE-2017-16995, CVE-2017-17862, CVE-2017-17863, CVE-2017-17864
SHA-256 | 3207e0826c0c9c18265d9ae379795f91daf1e13e098ed46e3ae67bdc4ad578b0
Ubuntu Security Notice USN-3532-2
Posted Jan 11, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3532-2 - USN-3523-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory. Various other issues were also addressed.

tags | advisory, kernel, local, vulnerability
systems | linux, ubuntu
advisories | CVE-2017-16995, CVE-2017-17862, CVE-2017-17863, CVE-2017-17864, CVE-2017-5754
SHA-256 | 77ce5cfd32550cb376de719462442e2dd40492997a26f59310fd9f5cbbfea5e6
Page 1 of 2
Back12Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close