what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 22 of 22 RSS Feed

Files Date: 2019-03-19

Microsoft Edge Flash click2play Bypass
Posted Mar 19, 2019
Authored by Ivan Fratric, Google Security Research

Microsoft Edge suffers from a Flash click2play bypass with CObjectElement::FinalCreateObject.

tags | exploit
advisories | CVE-2019-0612
SHA-256 | fdda336815ac63fe08759882eed8c25471acba4310abb045c2527612f4538060
VBScript VbsErase Memory Corruption
Posted Mar 19, 2019
Authored by Ivan Fratric, Google Security Research

There is an issue in VBScript in the VbsErase function. In some cases, VbsErase fails to clear the argument variable properly, which can trivially lead to crafting a variable with the array type, but with a pointer controlled controlled by an attacker.

tags | exploit
advisories | CVE-2019-0667
SHA-256 | e3cbf1077875f9a05eea70f53538809230cbe1a14641ae99c456cce2835e9409
GNU Privacy Guard 2.2.14
Posted Mar 19, 2019
Site gnupg.org

GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions.

Changes: Multiple code updates and an updated Russian translation.
tags | tool, encryption
SHA-256 | 1bf9ed46dc1ec5d8cfa13ba1ad47f94981f3b6a7ec16ad9123cc2549c4cbf87b
JFrog Artifactory Pro 6.5.9 Signature Validation
Posted Mar 19, 2019
Authored by Timo Juhani Lindfors

The SAML SSO addon in JFrog Artifactory version 6.5.9 does not properly validate the XML signature in the SAMLResponse field send to the URL /webapp/saml/loginResponse. An attacker can use this flaw to login as any user if they already can login as some user.

tags | exploit
advisories | CVE-2018-19971
SHA-256 | 2210b15f819271c6a55202eb862e9978ee5dcea5cb47625f5426dc464569ec4d
Slackware Security Advisory - libssh2 Updates
Posted Mar 19, 2019
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New libssh2 packages are available for Slackware 14.2 and -current to fix security issues.

tags | advisory
systems | linux, slackware
advisories | CVE-2019-3855, CVE-2019-3856, CVE-2019-3857, CVE-2019-3858, CVE-2019-3859, CVE-2019-3860, CVE-2019-3861, CVE-2019-3862, CVE-2019-3863
SHA-256 | fdb3fcc010d3bb0703e700dfb40e08b1ab9651ec7797a5e379ce91b14de2ca66
Debian Security Advisory 4409-1
Posted Mar 19, 2019
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4409-1 - Erik Olof Gunnar Andersson discovered that incorrect validation of port settings in the iptables security group driver of Neutron, the OpenStack virtual network service, could result in denial of service in a multi tenant setup.

tags | advisory, denial of service
systems | linux, debian
advisories | CVE-2019-9735
SHA-256 | 368cd395f5b140bbcb545c37df7d256407e2b6dea2573867aa6fc9a29c5f6cc9
Red Hat Security Advisory 2019-0600-01
Posted Mar 19, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0600-01 - Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller framework for web application development. Action Pack implements the controller and the view components. Issues addressed include a deserialization vulnerability.

tags | advisory, web, ruby
systems | linux, redhat
advisories | CVE-2018-16476
SHA-256 | 24506c94945d77f1e69082d8877ef9e168907f81511d95811e8962ffa7ee64a0
Gentoo Linux Security Advisory 201903-15
Posted Mar 19, 2019
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201903-15 - Multiple vulnerabilities have been found in NTP, the worst of which could result in the remote execution of arbitrary code. Versions less than 4.2.8_p13 are affected.

tags | advisory, remote, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2018-12327, CVE-2019-8936
SHA-256 | eeba10aa41c8236e0d57e96ec364f7f0bda2a9f0a77b6dde38cd6a4b9fb93411
Chrome StoragePartitionService Double-Destruction Race
Posted Mar 19, 2019
Authored by Google Security Research, Mark Brand

There's a race condition in the destruction of the BindingState for bindings to the StoragePartitionService in Chrome. It looks like the root cause of the issue is that since we can get two concurrent calls to callbacks returned from mojo::BindingSet::GetBadMessageCallback() from the same BindingSet, which results in a data race destroying the same BindingState.

tags | exploit, root
advisories | CVE-2019-5797
SHA-256 | e74b2b8256d75d7a1f9c0936ff14ed0a0b8cf12cea0653834d4403581f08f4b0
Microsoft Windows IE11 VBScript Execution Policy Bypass In MSHTML
Posted Mar 19, 2019
Authored by James Forshaw, Google Security Research

MSHTML only checks for the CLSID associated with VBScript when blocking in the Internet Zone, but doesn't check other VBScript CLSIDs which allow a web page to bypass the security zone policy.

tags | exploit, web
advisories | CVE-2019-0768
SHA-256 | a033e526788dc652d88a6718933e8da263d965274cd8d51465eee224f1f23696
Chrome MidiManagerWin Use-After-Free
Posted Mar 19, 2019
Authored by Google Security Research, Mark Brand

Chrome suffers from a use-after-free vulnerability in MidiManagerWin.

tags | exploit
advisories | CVE-2019-5789
SHA-256 | 5561abfbf792852e4be2a5a6f9908418ba3bb61c352292347a907340f971abf6
Chrome FileSystemOperationRunner Use-After-Free
Posted Mar 19, 2019
Authored by Google Security Research, Mark Brand

Chrome suffers from a use-after-free vulnerability in FileSystemOperationRunner.

tags | exploit
advisories | CVE-2019-5788
SHA-256 | 175e33f2fe84321b31ba9922dcb3c0c36eff272a29a2b1a39380be7b60162958
Advanced Host Monitor 11.92 Beta Local Buffer Overflow
Posted Mar 19, 2019
Authored by Peyman Forouzan

Advanced Host Monitor version 11.92 Beta suffers from a buffer overflow vulnerability.

tags | exploit, overflow
SHA-256 | 991f24e5abedf0208aaf8909cb74bb3f4da2987ea0625e395168ad6efb12aea7
Chrome ExtensionsGuestViewMessageFilter Data Race
Posted Mar 19, 2019
Authored by Google Security Research, Mark Brand

There appears to be a race condition in the destruction of the ExtensionsGuestViewMessageFilter if the ProcessIdToFilterMap is modified concurrently in Chrome.

tags | exploit
advisories | CVE-2019-5796
SHA-256 | 153cc2f98cfe6458909e177b32d616e5357adc7532ae04962d456870e9b99131
Abine Blur 7.8.24x Authentication Bypass
Posted Mar 19, 2019
Authored by RS Tyler Schroder

The Password Manager Extension in Abine Blur versions 7.8.24x allows attackers to bypass the multi-factor authentication and macOS disk-encryption protection mechanisms, and consequently exfiltrate secured data, because the right-click context menu is not secured. NOTE: this vulnerability exists because of a CVE-2018-7213 regression.

tags | advisory, bypass
advisories | CVE-2018-7213, CVE-2019-6481
SHA-256 | d3eb22c37afbe328ea52dfe0b3495fc88d89d8a4c97d74acb0389578a1bbcf37
eNdonesia Portal 8.7 Iframe Injection / SQL Injection
Posted Mar 19, 2019
Authored by Mehmet Emiroglu

eNdonesia Portal version 8.7 suffers from remote SQL injection and iframe injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
SHA-256 | 41b84ab34be5877ca18d905eeee6474e22e36e8aaa89b3eee420bcc443861ca6
Netartmedia PHP Mall 4.1 SQL Injection
Posted Mar 19, 2019
Authored by Ahmet Umit Bayram

Netartmedia PHP Mall version 4.1 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, php, sql injection
SHA-256 | 9b66d537d32b242cc56ff43abfd92b0709a01c6777547e439f392de1cff4abb8
Gila CMS 1.9.1 Cross Site Scripting
Posted Mar 19, 2019
Authored by Ahmet Umit Bayram

Gila CMS version 1.9.1 suffers from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2019-9647
SHA-256 | cececfc54d68461e108ae5f091aeab3df0c530f0f51ee7f09e729bf7d1a2f9b7
Netartmedia Event Portal 2.0 SQL Injection
Posted Mar 19, 2019
Authored by Ahmet Umit Bayram

Netartmedia Event Portal version 2.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 5a44080084849def55ffca9f3edc849f7c32ad5b324e6b66de6a171f238655c8
Netartmedia Real Estate Portal 5.0 SQL Injection
Posted Mar 19, 2019
Authored by Ahmet Umit Bayram

Netartmedia Real Estate Portal version 5.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
SHA-256 | 976790f17d6a0a343305ec3e7fd444eee43b7d9f3bb975b491b64eb7a89f4935
MyBB Upcoming Events 1.32 Cross Site Scripting
Posted Mar 19, 2019
Authored by 0xB9

MyBB Upcoming Events plugin version 1.32 suffers from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2019-9650
SHA-256 | 40d568e3193578e0d130eff7d2b6b0d39f9ce083e43ce1526c5dae38735b037a
Jenkins ACL Bypass / Metaprogramming Remote Code Execution
Posted Mar 19, 2019
Authored by Orange Tsai, wvu | Site metasploit.com

This Metasploit module exploits a vulnerability in Jenkins dynamic routing to bypass the Overall/Read ACL and leverage Groovy metaprogramming to download and execute a malicious JAR file. The ACL bypass gadget is specific to Jenkins versions 2.137 and below and will not work on later versions of Jenkins. Tested against Jenkins 2.137 and Pipeline: Groovy Plugin 2.61.

tags | exploit
advisories | CVE-2019-1003000, CVE-2019-1003001, CVE-2019-1003002
SHA-256 | 1fa7a0581a082a2a0c1e14681f05b88994d45c7f8daeb7fbed7b6dacc77b9a72
Page 1 of 1
Back1Next

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close