Twenty Year Anniversary
Showing 1 - 15 of 15 RSS Feed

Files Date: 2018-06-18

Microsoft COM For Windows Improper Serialized Object Handling
Posted Jun 18, 2018
Authored by Code White | Site codewhitesec.blogspot.com

Microsoft COM for Windows privilege escalation proof of concept exploit. A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. The security update addresses the vulnerability by correcting how "Microsoft COM for Windows" handles serialized objects.

tags | exploit, remote, web, code execution, proof of concept
systems | windows
advisories | CVE-2018-0624
MD5 | 96f4a2c83114fc51a56f27a6b609fa56
MagniComp SysInfo Information Exposure
Posted Jun 18, 2018
Authored by Harry Sintonen

MagniComp SysInfo contains a information exposure vulnerability through debug functionality. Versions SysInfo 10-H81 and above are not affected.

tags | exploit, info disclosure
advisories | CVE-2018-7268
MD5 | 05af244c6663efde83caac79a67b4878
RabbitMQ Web Management Cross Site Request Forgery
Posted Jun 18, 2018
Authored by Dolev Farhi

RabbitMQ Web Management versions prior to 3.7.6 suffer from a cross site request forgery vulnerability.

tags | exploit, web, csrf
MD5 | 0e90026ca7e02938b9b68fbc91cea5ca
Pale Moon Browser Use-After-Free
Posted Jun 18, 2018
Authored by Berk Cem Goksel

Pale Moon Browser versions prior to 27.9.3 suffer from a use-after-free vulnerability.

tags | exploit
advisories | CVE-2018-12292
MD5 | e4036d6b66047ae0fac41ded1bba4462
Nikto 2.1.6 CSV Injection
Posted Jun 18, 2018
Authored by Adam Greenhill

Nikto version 2.1.6 suffers from a csv injection vulnerability.

tags | exploit
advisories | CVE-2018-11652
MD5 | aedc26323562020a43750f0d92a863ca
Redatam Web Server Directory Traversal
Posted Jun 18, 2018
Authored by Berk Dusunur

Redatam Web Server prior to version 7 suffer from a directory traversal vulnerability.

tags | exploit, web, file inclusion
MD5 | 0584808e1c49454251c2d5a7207ce5ef
Redis-cli Buffer Overflow
Posted Jun 18, 2018
Authored by Fakhri Zulkifli

Redis-cli versions prior to 5.0 buffer overflow proof of concept exploit.

tags | exploit, overflow, proof of concept
advisories | CVE-2018-12326
MD5 | a53747670c7b2fd888620a15cd0610c7
Audiograbber 1.83 Buffer Overflow
Posted Jun 18, 2018
Authored by Dennis Herrmann

Audiograbber version 1.83 local SEH buffer overflow exploit.

tags | exploit, overflow, local
MD5 | 8737acad1660bbb2394fd9aba67a272f
Joomla Jomres 9.11.2 Cross Site Request Forgery
Posted Jun 18, 2018
Authored by Borna Nematzadeh

Joomla Jomres component version 9.11.2 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
MD5 | 85f5c9da3da7654810d5acb079efaa95
phpMyAdmin 4.x Remote Code Execution
Posted Jun 18, 2018
Authored by Matteo Cantoni, Cure53, Michal AihaA | Site metasploit.com

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.

tags | exploit, remote, arbitrary, php
advisories | CVE-2016-5734
MD5 | 40f298aed179561d60e3ea947664bb79
Tapplock Smart Lock Insecure Direct Object Reference
Posted Jun 18, 2018
Authored by Vangelis Stykas

Tapplock Smart Lock suffers from multiple insecure direct object reference vulnerabilities.

tags | exploit, vulnerability
MD5 | 763446d7594572376c209584efb7e078
Ubuntu Security Notice USN-3675-3
Posted Jun 18, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3675-3 - USN-3675-1 fixed a vulnerability in GnuPG. This update provides the corresponding update for Ubuntu 12.04 ESM. Marcus Brinkmann discovered that during decryption or verification, GnuPG did not properly filter out terminal sequences when reporting the original filename. An attacker could use this to specially craft a file that would cause an application parsing GnuPG output to incorrectly interpret the status of the cryptographic operation reported by GnuPG. Various other issues were also addressed.

tags | advisory
systems | linux, ubuntu
advisories | CVE-2018-12020
MD5 | 563a9a928ab29560f4bcb9624b999abd
Ubuntu Security Notice USN-3687-1
Posted Jun 18, 2018
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3687-1 - A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

tags | advisory, remote, web, denial of service, arbitrary, javascript, code execution, xss
systems | linux, ubuntu
advisories | CVE-2018-12293, CVE-2018-4190, CVE-2018-4199, CVE-2018-4218, CVE-2018-4222, CVE-2018-4232, CVE-2018-4233
MD5 | 55bf9fa9e7a0502036a4c6a0c0d90f46
Debian Security Advisory 4231-1
Posted Jun 18, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4231-1 - It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys.

tags | advisory, local
systems | linux, debian
advisories | CVE-2018-0495
MD5 | 8b7597b32fc2a2f158d2624d6e507119
Debian Security Advisory 4230-1
Posted Jun 18, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4230-1 - Multiple vulnerabilities were discovered in the Lua subsystem of Redis, a persistent key-value database, which could result in denial of service.

tags | advisory, denial of service, vulnerability
systems | linux, debian
advisories | CVE-2018-11218, CVE-2018-11219
MD5 | d712eead66cabe92230211edff8d985f
Page 1 of 1
Back1Next

File Archive:

November 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    10 Files
  • 2
    Nov 2nd
    15 Files
  • 3
    Nov 3rd
    2 Files
  • 4
    Nov 4th
    2 Files
  • 5
    Nov 5th
    32 Files
  • 6
    Nov 6th
    27 Files
  • 7
    Nov 7th
    8 Files
  • 8
    Nov 8th
    9 Files
  • 9
    Nov 9th
    17 Files
  • 10
    Nov 10th
    2 Files
  • 11
    Nov 11th
    2 Files
  • 12
    Nov 12th
    33 Files
  • 13
    Nov 13th
    29 Files
  • 14
    Nov 14th
    23 Files
  • 15
    Nov 15th
    45 Files
  • 16
    Nov 16th
    1 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close