On Microsoft Windows, the SMB server drivers (srv.sys and srv2.sys) do not check the destination of a NTFS mount point when manually handling a reparse operation leading to being able to locally open an arbitrary device via an SMB client which can result in privilege escalation.
18c5e8b69488f509de251342dd3e47d18e57b85a83a80396d794f1f67e9b08c0On Microsoft Windows, when impersonating the anonymous token in an LPAC the WIN://NOAPPALLPKG security attribute is ignored leading to impersonating a non-LPAC token leading to privilege escalation.
ea9947419e769dd9e18edeb304390de5704daee25ebd8b4d342bdc9bfc87ebeaOn Microsoft Windows, the check for an AC token when impersonating the anonymous token does not check impersonation token's security level leading to impersonating a non-AC anonymous token leading to privilege escalation.
25a65ee6cfd0f1fa9da6eec73313f59622aaad24e48dd564fccff23fab03b387When creating a new file on an NTFS drive it's possible to circumvent security checks for setting an arbitrary owner and mandatory label leading to a non-admin user setting those parts of the security descriptor with non-standard values which could result in further attacks resulting privilege escalation.
9f879ee71e885a24959ae7270d898aeb86356fd6f7338f21bc7cc2accad3c7a8Debian Linux Security Advisory 4083-1 - Stephan Zeisberg discovered that poco, a collection of open source C++ class libraries, did not correctly validate file paths in ZIP archives. An attacker could leverage this flaw to create or overwrite arbitrary files.
17161b54707cb0c6dff7a79893bbc4d50aa757d637c78da205274c22de089bf3VMware Security Advisory 2018-0005 - VMware Workstation, and Fusion updates resolve use-after-free and integer-overflow vulnerabilities.
c55eb4b61afe1e1236e68c13ef43af9c894b17642cfeb6b30500ac46f62ecd75VMware Security Advisory 2018-0004.1 - VMware vSphere, Workstation and Fusion updates add Hypervisor- Assisted Guest remediation for speculative execution issue.
3c7f5251b5e0644abc3bb94af6093929973933a6eaf75dd6d6a0dd89c7e5de52112 bytes small Linux/ARM (Raspberry Pi) null-free shellcode that binds a shell to 0.0.0.0:4444/TCP.
d5f25826776a31e42e29e868cae7d248c9190fbbbe3abafab9a10ef3ba422041This Metasploit module exploits a buffer overflow in the LabF nfsAxe 3.7 FTP Client allowing remote code execution.
241e34b13eab130be620a23f461dd59501c6111482d96e813435aadcb049ca4bThis Metasploit module exploits an unrestricted file upload vulnerability in Web Viewer 1.0.0.193 on Samsung SRN-1670D devices. The network_ssl_upload.php file allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a direct request to the file in the upload/ directory. To authenticate for this attack, one can obtain web-interface credentials in cleartext by leveraging the existing local file read vulnerability referenced by CVE-2015-8279, which allows remote attackers to read the web interface credentials by sending a request to: cslog_export.php?path=/root/php_modules/lighttpd/sbin/userpw URI.
01dd3eafd05e3df998f5fcb41b54bc9db77b1c53fd0d923b9b36d3070206c261This Metasploit module exploits a file upload vulnerability in phpCollab version 2.5.1 which could be abused to allow unauthenticated users to execute arbitrary code under the context of the web server user. The exploit has been tested on Ubuntu 16.04.3 64-bit
45d36cc04840bd87751a09ee05da85fea9974f7260a94093b39bf929c1b8981eRed Hat Security Advisory 2018-0081-01 - The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 28.0.0.137. Security Fix: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletins listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to disclose sensitive information or modify its settings when the victim loaded a page containing the malicious SWF content.
28fd1431bf0cb04ae2f8f3c9ff3c043d8a73c829c878f37a14b049198351e0c3Ubuntu Security Notice 3522-4 - USN-3522-2 fixed a vulnerability in the Linux Hardware Enablement kernel for Ubuntu 14.04 LTS to address Meltdown. Unfortunately, that update introduced a regression where a few systems failed to boot successfully. This update fixes the problem. Various other issues were also addressed.
6862be761b1dcb30b91a643bb46e4863f5340befc61f688864daa1afed24e505WordPress Testimonial Slider plugin versions 1.2.4 and below suffer from a remote SQL injection vulnerability.
4843ea7190a8b03ec20a9232c6f5a6ded3adba6e253edb278b67f49e681f02b0WordPress Smooth Slider plugin versions 2.8.6 and below suffer from a remote SQL injection vulnerability.
969899dce42308e6793f299ffa4d732c1287d84bb8b4576223cafa7d5fed6dceWordPress Dbox 3D Slide Lite plugin versions 1.2.2 and below suffer from multiple remote SQL injection vulnerabilities.
5528cd5d06c970cf9130914fc542c9f448c79f182518089b7000c271a6fad1dbWordPress MQ ReLinks plugin version 1.8 suffers from cross site scripting and open redirection vulnerabilities.
fc518af6564abf5f1e7617a5d60b9fc3cd71b5891344028bf3c213f96ffdf7bbJoomla! Easydiscuss component versions prior to 4.0.21 suffer from a cross site scripting vulnerability.
c960d37c89bf05306a37c2cf452544e7ec2f90ce0081a3636a471ab6210d61a5Jungo Windriver version 12.5.1 suffers from a privilege escalation vulnerability.
fc734e85e062abc03c9384d3cfac0e77d5dfab9348f5c5d7d19be424892313b4Ubuntu Security Notice 3522-3 - USN-3522-1 fixed a vulnerability in the Linux kernel to address Meltdown. Unfortunately, that update introduced a regression where a few systems failed to boot successfully. This update fixes the problem. Various other issues were also addressed.
3d888a24e68dcf009147e529cc3b6ec39359c7c07037e2215fe1c2bff50e9247Many TP-Link products suffer from multiple authenticated remote command injection vulnerabilities.
2a4a4012702f3e672405556f143a7f5f9ab5511b05a1ecf69704a91de84485dcUbuntu Security Notice 3528-1 - It was discovered that Ruby incorrectly handled certain terminal emulator escape sequences. An attacker could use this to execute arbitrary code via a crafted user name. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. It was discovered that Ruby incorrectly handled certain strings. An attacker could use this to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. Various other issues were also addressed.
88d323ec80f067827ae8c99ddded9ca9db51fec211fa2406a877e03ffa4a9ecbUbuntu Security Notice 3527-1 - Joseph Bisch discovered that Irssi incorrectly handled incomplete escape codes. If a user were tricked into using malformed commands or opening malformed files, an attacker could use this issue to cause Irssi to crash, resulting in a denial of service. Joseph Bisch discovered that Irssi incorrectly handled settings the channel topic without specifying a sender. A malicious IRC server could use this issue to cause Irssi to crash, resulting in a denial of service. Various other issues were also addressed.
b2e9a71756d5b11b35c7c174fb15cae2d4c4ff27170f2e36a05fde4350c800a0Ubuntu Security Notice 3523-3 - Jann Horn discovered that the Berkeley Packet Filter implementation in the Linux kernel did not properly check the relationship between pointer values and the BPF stack. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Jann Horn discovered that the Berkeley Packet Filter implementation in the Linux kernel improperly performed sign extension in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.
3207e0826c0c9c18265d9ae379795f91daf1e13e098ed46e3ae67bdc4ad578b0Ubuntu Security Notice 3532-2 - USN-3523-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory. Various other issues were also addressed.
77ce5cfd32550cb376de719462442e2dd40492997a26f59310fd9f5cbbfea5e6
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Subscribe to an RSS Feed