Twenty Year Anniversary
Showing 1 - 25 of 275 RSS Feed

Files Date: 2018-10-01 to 2018-10-31

Microsoft Windows SetImeInfoEx Win32k NULL Pointer Dereference
Posted Oct 19, 2018
Authored by unamer, Dhiraj Mishra, bigric3, Anton Cherepanov | Site metasploit.com

This Metasploit module exploits an elevation of privilege vulnerability that exists in Windows 7 and 2008 R2 when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This Metasploit module is tested against windows 7 x86, windows 7 x64 and windows server 2008 R2 standard x64.

tags | exploit, arbitrary, x86, kernel
systems | windows, 7
advisories | CVE-2018-8120
MD5 | 967e04838b302049cc237c549437ccec
OpenSSH 7.9p1
Posted Oct 19, 2018
Authored by Damien Miller | Site openssh.com

This is a Linux/portable port of OpenBSD's excellent OpenSSH. OpenSSH is based on the last free version of Tatu Ylonen's SSH with all patent-encumbered algorithms removed, all known security bugs fixed, new features reintroduced, and many other clean-ups.

Changes: Now requires OpenSSL 1.1.x series 1.1.0g or greater. Various other updates.
tags | tool, encryption
systems | linux, unix, openbsd
MD5 | c6af50b7a474d04726a5aa747a5dce8f
Microsoft Security Bulletin CVE Addition For October, 2018
Posted Oct 19, 2018
Site microsoft.com

This Microsoft bulletin summary lists a new CVE that has been added to the October advisory.

tags | advisory
advisories | CVE-2018-8569
MD5 | 1dc0c5c62a9f28e2159092f011e2aa84
Viprinet VPN Hub Router Cross Site Scripting
Posted Oct 19, 2018
Authored by Denis Kolegov, SD-WAN New Hope Team

Viprinet VPN Hub Router suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 5a9e2aaf91108203d85e5d8867335380
WiFiRanger 7.0.8rc3 Incorrect Access Control / Privilege Escalation
Posted Oct 19, 2018
Authored by Mitchel Jordan

WiFiRanger version 7.0.8rc3 suffers from an incorrect access control that allows for ftp retrieval of an RSA identity that an attacker can use to ssh in as root.

tags | exploit, root
advisories | CVE-2018-17873
MD5 | 301d05eb6ae49dff97112c3a73c88308
CA Identity Governance Username Enumeration
Posted Oct 19, 2018
Authored by Kevin Kotas, Jake Miller | Site www3.ca.com

CA Technologies Support is alerting customers to a low risk issue with CA Identity Governance. In a certain product configuration, an attacker can gain sensitive information. CA published solutions to address the vulnerability. The vulnerability occurs due to how CA Identity Governance responds to login requests. An attacker may exploit the vulnerability to enumerate account names. Affected products include CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 and CA Identity Governance 12.6, 14.0, 14.1, and 14.2.

tags | advisory
advisories | CVE-2018-14597
MD5 | edd8d4c02d9b41c0d86a0cb630e1ee93
libSSH Authentication Bypass
Posted Oct 19, 2018
Authored by Dayanc Soyadli

libSSH suffers from an authentication bypass vulnerability.

tags | exploit, bypass
advisories | CVE-2018-10933
MD5 | 88d03f3ff24b6086e8b4eee16645332c
Zoho ManageEngine OpManager 12.3 Arbitrary File Upload
Posted Oct 19, 2018
Authored by Murat Aydemir, Hakan Bayir

Zoho ManageEngine OpManager version 12.3 suffers from an arbitrary file upload vulnerability.

tags | advisory, arbitrary, file upload
advisories | CVE-2018-18475
MD5 | b73044f9aa33dc3ee3303e3f5cfab8f1
Apple Intel GPU Driver Use-After-Free / Double-Delete
Posted Oct 19, 2018
Authored by Google Security Research, ianbeer

The Apple Intel GPU driver suffers from use-after-free and double-delete issues due to bad locking.

tags | advisory
systems | apple
advisories | CVE-2018-4334
MD5 | b351e27cbcb6569d7e176048b1d1639f
iOS / macOS HID Event System Sandbox Escape
Posted Oct 19, 2018
Authored by Google Security Research, ianbeer

iOS and macOS suffers from a sandbox escape due to trusted length field in shared memory used by the HID event subsystem.

tags | advisory
systems | ios
MD5 | d02085ca3eebe96590a6bfad12954bf6
iOS copyin Check Kernel Stack Memory Disclosure
Posted Oct 19, 2018
Authored by Google Security Research, ianbeer

iOS suffers from a kernel stack memory disclosure due to failure to check copyin return value.

tags | advisory, kernel
systems | cisco, ios
advisories | CVE-2018-4363
MD5 | dabae5d2d2f7dfbc02093d00e56e96e6
iOS / macOS MIG Object Lifetime Semantics Sandbox Escape
Posted Oct 19, 2018
Authored by Google Security Research, ianbeer

iOS and macOS suffer from a sandbox escape vulnerability due to failure to comply with MIG object lifetime semantics in the iohideventsystem_client subsystem.

tags | advisory
systems | apple
MD5 | b9de50e80a2ea80f7f9468bd16b597e3
iOS / macOS MIG Sandbox Escape
Posted Oct 19, 2018
Authored by Google Security Research, ianbeer

iOS and macOS suffer from sandbox escape vulnerabilities due to MIG failing to use correct out-of-line descriptor lengths when parsing reply messages.

tags | advisory, vulnerability
systems | ios
MD5 | 4f22a8f810b85991d35e76ab7b9861b4
iOS / macOS IOHIDResourceQueue::enqueueReport Integer Overflow
Posted Oct 19, 2018
Authored by Google Security Research, ianbeer

iOS and macOS suffers from a kernel memory corruption vulnerability due to integer overflow in IOHIDResourceQueue::enqueueReport.

tags | advisory, overflow, kernel
MD5 | eaf771ae19474d20de705e51b77b51d3
iOS / macOS Mach Message Sandbox Escape
Posted Oct 19, 2018
Authored by Google Security Research, ianbeer

iOS and macOS suffers from a sandbox escape vulnerability due to mach message sent from shared memory.

tags | advisory
systems | ios
MD5 | 212667e2b57588da87c0742e251ac563
iOS Kernel Personas Use-After-Free
Posted Oct 19, 2018
Authored by Google Security Research, ianbeer

The iOS kernel suffers from a use-after-free vulnerability due to bad error handling in personas.

tags | advisory, kernel
systems | ios
advisories | CVE-2018-4337
MD5 | 00aa8ae882f2b6020f3e4a12749da1ee
Red Hat Security Advisory 2018-2949-01
Posted Oct 18, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2949-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include out-of-bounds write vulnerability.

tags | advisory, javascript
systems | linux, redhat
advisories | CVE-2018-12115
MD5 | 99a367702b684fdf400d41ee1478eb2a
Red Hat Security Advisory 2018-2946-01
Posted Oct 18, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2946-01 - Red Hat Openshift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. The RHOAR Eclipse Vert.x 3.5.4 release serves as a replacement for RHOAR Eclipse Vert.x 3.5.3, and includes bug fixes and enhancements. For a detailed list of issues resolved in the community Eclipse Vert.x 3.5.4 release, see the release notes in the References section. Issues addressed include an API validation flaw and a problem where the WebSocket HTTP upgrade implementation holds the entire http request in memory before the handshake.

tags | advisory, web
systems | linux, redhat
advisories | CVE-2018-12541, CVE-2018-12544
MD5 | da115969bfddee040383d0a69ab8841d
Red Hat Security Advisory 2018-2944-01
Posted Oct 18, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2944-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include an out-of-bounds write vulnerability.

tags | advisory, javascript
systems | linux, redhat
advisories | CVE-2018-12115
MD5 | c9342f5d00ef12e9694c240bcf0e06c9
Red Hat Security Advisory 2018-2945-01
Posted Oct 18, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2945-01 - Red Hat Openshift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. This release of RHOAR Spring Boot 1.5.16 serves as a replacement for RHOAR Spring Boot 1.5.15, and includes bug fixes and enhancements. For further information, refer to the Release Notes linked to in the References section. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2018-1336
MD5 | 0ffe81da03b202a9d03e29d0b7501071
Ghostscript 1Policy Dangerous Access To Operator
Posted Oct 18, 2018
Authored by Tavis Ormandy, Google Security Research

Ghostscript has an issues where callers of a procedure are not forced to be properly marked as executeonly or pseudo-operators, allowing for the ability to take complete control of it.

tags | advisory
advisories | CVE-2018-18284
MD5 | f6013aa13df201f50c343927fca57dcd
Linux BPF Verifier Failed Truncation
Posted Oct 18, 2018
Authored by Jann Horn, Google Security Research

The Linux BPF verifier has an issue where 32-bit RSH verification does not truncate input before the ALU op.

tags | advisory
systems | linux
advisories | CVE-2018-18445
MD5 | 373edc458d7e0a3a57e28573408ae811
Linux Semi-Arbitrary Task Stack Read On ARM64 / x86
Posted Oct 18, 2018
Authored by Jann Horn, Google Security Research

Linux suffers from a semi-arbitrary task stack read on ARM64 (and x86) via /proc/$pid/stack.

tags | advisory, arbitrary, x86
systems | linux
MD5 | 7100e417a396e293988088f73c3b7c3a
Chrome Mojo DataPipe*Dispatcher Deserialization Lacking Validation
Posted Oct 18, 2018
Authored by Google Security Research, Mark Brand

Chrome has missing validation in the deserialization routines for both DataPipeConsumerDispatcher and DataPipeProducerDispatcher, which take from the incoming message a read_offset/write_offset respectively into shared memory. Providing an offset outside the bounds of the allocated memory will then result in an out-of-bounds read/write when the pipe is used.

tags | advisory
advisories | CVE-2018-16068
MD5 | 08315707021518b918593c1b05081689
OwnTicket 1.0 SQL Injection
Posted Oct 18, 2018
Authored by Ihsan Sencan

OwnTicket version 1.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 971c98dc732f76cc5a566f0ad1449e62
Page 1 of 11
Back12345Next

File Archive:

October 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    26 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    2 Files
  • 7
    Oct 7th
    3 Files
  • 8
    Oct 8th
    23 Files
  • 9
    Oct 9th
    16 Files
  • 10
    Oct 10th
    15 Files
  • 11
    Oct 11th
    19 Files
  • 12
    Oct 12th
    16 Files
  • 13
    Oct 13th
    2 Files
  • 14
    Oct 14th
    2 Files
  • 15
    Oct 15th
    15 Files
  • 16
    Oct 16th
    20 Files
  • 17
    Oct 17th
    19 Files
  • 18
    Oct 18th
    21 Files
  • 19
    Oct 19th
    16 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close