what you don't know can hurt you
Showing 1 - 25 of 451 RSS Feed

Files Date: 2019-11-01 to 2019-11-30

WordPress Plainview Activity Monitor 20161228 Remote Command Execution
Posted Nov 29, 2019
Authored by Leo LE BOUTER | Site metasploit.com

WordPress Plainview Activity Monitor plugin is vulnerable to OS command injection which allows an attacker to remotely execute commands on the underlying system. Application passes unsafe user supplied data to ip parameter into activities_overview.php. Privileges are required in order to exploit this vulnerability. Vulnerable plugin version: 20161228 and possibly prior. Fixed plugin version: 20180826.

tags | exploit, php
advisories | CVE-2018-15877
MD5 | 8bacd47eae727e0caea978775817a289
Debian Security Advisory 4578-1
Posted Nov 29, 2019
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4578-1 - Multiple security issues were found in libvpx multimedia library which could result in denial of service and potentially the execution of arbitrary code if malformed WebM files are processed.

tags | advisory, denial of service, arbitrary
systems | linux, debian
advisories | CVE-2019-9232, CVE-2019-9325, CVE-2019-9371, CVE-2019-9433
MD5 | 8d73be098508bd36c628ce84936f91c2
axTLS 2.1.5 Denial Of Service
Posted Nov 29, 2019
Authored by Robert Horr

Multiple denial of service vulnerabilities have been discovered and disclosed in the axTLS library versions 2.1.5 and below.

tags | advisory, denial of service, vulnerability
advisories | CVE-2019-10013, CVE-2019-9689
MD5 | d19632244913b29df1e0c7ca2bc77e5a
OwnCloud 8.1.8 Username Disclosure
Posted Nov 29, 2019
Authored by Daniel Moreno

OwnCloud version 8.1.8 suffers from a username disclosure vulnerability.

tags | exploit, info disclosure
MD5 | 757c36179daa923d31563d7d6f7b1f5f
Bash 5.0 Patch 11 Privilege Escalation
Posted Nov 29, 2019
Authored by Mohin Paramasivam, Chet Ramey, Ian Pudney

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

tags | exploit, shell, bash
systems | linux
advisories | CVE-2019-18276
MD5 | 839a835373eff1043e2c6d5d697405eb
Online Inventory Manager 3.2 Cross Site Scripting
Posted Nov 29, 2019
Authored by Cemal Cihad CiFTCi

Online Inventory Manager version 3.2 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 6ac161329333e8c549273ff3dd783e15
Ubuntu Security Notice USN-4204-1
Posted Nov 28, 2019
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4204-1 - Riccardo Schirone discovered that psutil incorrectly handled certain reference counting operations. An attacker could use this issue to cause psutil to crash, resulting in a denial of service, or possibly execute arbitrary code.

tags | advisory, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2019-18874
MD5 | 246fe48001bbea222c530155fafe998b
Debian Security Advisory 4577-1
Posted Nov 28, 2019
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4577-1 - Tim Dusterhus discovered that haproxy, a TCP/HTTP reverse proxy, did not properly sanitize HTTP headers when converting from HTTP/2 to HTTP/1. This would allow a remote user to perform CRLF injections.

tags | advisory, remote, web, tcp
systems | linux, debian
advisories | CVE-2019-19330
MD5 | 136682b36788547ff6b9f48e09a65017
SpotAuditor 5.3.2 Denial Of Service
Posted Nov 28, 2019
Authored by ZwX

SpotAuditor version 5.3.2 Name and Key proof of concept denial of service exploits.

tags | exploit, denial of service, proof of concept
MD5 | d66f0f8c99963521d186ed04b3546271
Mersive Solstice 2.8.0 Remote Code Execution
Posted Nov 28, 2019
Authored by Alexandre Teyar

Mersive Solstice version 2.8.0 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2017-12945
MD5 | f3903fc24965899d871de9de55475185
GHIA CamIP 1.2 For iOS Denial Of Service
Posted Nov 28, 2019
Authored by Ivan Marmolejo

GHIA CamIP version 1.2 for iOS suffers from a denial of service vulnerability.

tags | exploit, denial of service
systems | ios
MD5 | 350fc3d2528c2e5ace3997ad02690935
TexasSoft CyberPlanet 6.4.131 Unquoted Service Path
Posted Nov 28, 2019
Authored by Cristian Ayala G

TexasSoft CyberPlanet version 6.4.131 suffers from a CCSrvProxy unquoted service path vulnerability.

tags | exploit
MD5 | cd722a5c463766d57ec9e2c1a003a472
WordPress 5.3 Username Enumeration
Posted Nov 28, 2019
Authored by sajjadbnd

WordPress version 5.3 suffers from a username enumeration vulnerability.

tags | exploit, info disclosure
MD5 | b263069a414f9bb50aa1628b813065d1
CBC Gem Unencrypted Transit
Posted Nov 28, 2019
Authored by David Coomber

The CBC Gem Android and iOS applications (Android version 9.24.0 and below, iOS version 9.24.0 and below) sends potentially sensitive information such as device model and resolution, mobile carrier, days since first use, days since last use, total number of app launches, number of app launches since upgrade, and previous app session length, unencrypted to both first and third party sites (Adobe Marketing Cloud, ScorecardResearch).

tags | advisory
systems | ios
MD5 | ddf0c0125210e18aad3d55c6060e572e
Ubuntu Security Notice USN-4203-2
Posted Nov 28, 2019
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4203-2 - USN-4203-1 fixed a vulnerability in NSS. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2019-11745
MD5 | e3c81da24686986b81918cb98c31ffce
Ubuntu Security Notice USN-4203-1
Posted Nov 28, 2019
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4203-1 - It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

tags | advisory, remote, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2019-11745
MD5 | 05573b211f4c44450d8676b2857ee497
Grub2 grub2-set-bootflag Environment Corruption
Posted Nov 27, 2019
Authored by Tavis Ormandy, Google Security Research

Grub2 has grub2-set-bootflag setuid in the new Fedora release and has the ability to corrupt the environment.

tags | exploit
systems | linux, fedora
MD5 | 521fcef9f7dbf428929332a5f1ece053
Packet Fence 9.2.0
Posted Nov 27, 2019
Site packetfence.org

PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.

Changes: Now allows to force the access duration when using device registration. Added audit log for API and new admin interface. Added configuration based switch modules. Various other additions.
tags | tool, remote
systems | unix
MD5 | 9e814654d1ade904d23ca004e56b0870
Red Hat Security Advisory 2019-4019-01
Posted Nov 27, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-4019-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.2.5 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.4, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.2.5 Release Notes for information about the most significant bug fixes and enhancements included in this release. Issues addressed include bypass and denial of service vulnerabilities.

tags | advisory, java, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2019-14838, CVE-2019-14843, CVE-2019-9511, CVE-2019-9512, CVE-2019-9514, CVE-2019-9515
MD5 | 87115a7601280067a7b46f9664a64f2a
Red Hat Security Advisory 2019-4018-01
Posted Nov 27, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-4018-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.2.5 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.4, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.2.5 Release Notes for information about the most significant bug fixes and enhancements included in this release. Issues addressed include bypass and denial of service vulnerabilities.

tags | advisory, java, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2019-14838, CVE-2019-14843, CVE-2019-9511, CVE-2019-9512, CVE-2019-9514, CVE-2019-9515
MD5 | aae190edf8594ff10d1a8ecb98f8cefe
Xiaomi Mi Box Display Corruption
Posted Nov 27, 2019
Authored by Bug Reporter

The vulnerability allows rescaling and corrupting the Xiaomi Mi Box (model: MIBOX3, build.id : MHC19) display without any privilege requirement, thus creating an opportunity for a non-privilege malicious app to disable the basic functionalities that the TV box is offering or can even be used for ransomware purpose - e.g., each time a target streaming app is launched, the malicious app can corrupt the display.

tags | exploit
MD5 | de7ea94c8301dc45448597ee55213bf1
BSidesLjubljana 2020 Call For Papers
Posted Nov 27, 2019
Site bsidesljubljana.si

B-Sides Ljubljana will be held April 4th, 2020 in Ljubljana, Slovenia.

tags | paper, conference
MD5 | cc75508f174a9d80d3f5e405effe1cc7
Red Hat Security Advisory 2019-4021-01
Posted Nov 27, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-4021-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.2.5 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.4, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.2.5 Release Notes for information about the most significant bug fixes and enhancements included in this release. Issues addressed include bypass and denial of service vulnerabilities.

tags | advisory, java, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2019-14838, CVE-2019-14843, CVE-2019-9511, CVE-2019-9512, CVE-2019-9514, CVE-2019-9515
MD5 | 3a95fce4e80361829ee75de88548e735
Red Hat Security Advisory 2019-4020-01
Posted Nov 27, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-4020-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.2.5 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.4, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.2.5 Release Notes for information about the most significant bug fixes and enhancements included in this release. Issues addressed include bypass and denial of service vulnerabilities.

tags | advisory, java, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2019-14838, CVE-2019-14843, CVE-2019-9511, CVE-2019-9512, CVE-2019-9514, CVE-2019-9515
MD5 | b1793fef4380b6c0c3ecac9b39987c73
Android-Gif-Drawable Double-Free
Posted Nov 27, 2019
Authored by Marcin Kozlowski

A double free vulnerability in the DDGifSlurp function in decoding.c in libpl_droidsonroids_gif before 1.2.15, as used in WhatsApp for Android before 2.19.244, allows remote attackers to execute arbitrary code or cause a denial of service. CVE-2019-11932 is a vulnerability in the android-gif-drawable library. Yet the CVE text doesn't mention "android-gif-drawable". It only mentions WhatsApp. There could be over 28,400 free Android apps that use this library.

tags | advisory, remote, denial of service, arbitrary
advisories | CVE-2019-11932
MD5 | a6614c2514fa1b374a4aab6d0310003c
Page 1 of 19
Back12345Next

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    1 Files
  • 20
    Sep 20th
    1 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    21 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close