sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.
f79dac9b60f40ccdb4e1a05797b7cdc6moziloCMS version 2.0 suffers from a persistent cross site scripting vulnerability.
bff0264ef0e365ae654bd0dadaf5dc3dMara CMS version 7.5 suffers from a remote code execution vulnerability.
01153c71819eaa4b8c162c658fe780abThis paper explains how the Nos-Santos-Izquierdo Field (NSIF) works, focusing in the similarities between the RSA problem, factorization, and the calculation decimal expansions.
d79eed2672631e469adcfb58d853b01eKamailio version 5.4.0 is vulnerable to header smuggling via a bypass of remove_hf.
105120a096c11895c654ec5a53e7893dRed Hat Security Advisory 2020-3598-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system.
0d3742eef33868d3f28a11d7624dba22Red Hat Security Advisory 2020-3592-01 - The bash packages provide Bash, which is the default shell for Red Hat Enterprise Linux.
6866e5562af91fd7c2e0245ba478bbd0Rebar3 versions 3.0.0-beta.3 through 3.13.2 suffer from a command injection vulnerability.
8127fb63c3513575f8e1080b8847e3ceSagemcom F@ST 5280 routers using firmware version 1.150.61, and possibly others, have an insecure deserialization vulnerability that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sess_id, nonce, and ha1 values inside of the serialized session cookie, an attacker may alter the user value inside of this cookie, and assume the role and permissions of the user specified. By assuming the role of the user internal, which is inaccessible to end users by default, the attacker gains the permissions of the internal account, which includes the ability to flash custom firmware to the router, allowing the attacker to achieve a complete compromise.
2e29a279e3f0441a3a7d075a6b67e5aeAs of 2020/09/01, all versions of Bagisto appear to leak database and email server credentials in the document root.
7fc061d5cf8581a756c5a61f9a15896fRed Hat Security Advisory 2020-3588-01 - LibVNCServer is a C library that enables you to implement VNC server functionality into own programs. Issues addressed include a buffer overflow vulnerability.
07df140530997268c9b25b94d0a08046Red Hat Security Advisory 2020-3587-01 - Red Hat Fuse provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat A-MQ is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat Fuse 6.3 and Red Hat A-MQ 6.3. It includes bug fixes, which are documented in the patch notes accompanying the package on the download page. Issues addressed include file disclosure and server-side request forgery vulnerabilities.
f62bfd5513ca21b278192262f6d5fa72Ubuntu Security Notice 4481-1 - It was discovered that FreeRDP incorrectly handled certain memory operations. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.
090b672f0d3e9db866a8396ad60db36cUbuntu Security Notice 4471-2 - USN-4471-1 fixed a vulnerability in Net-SNMP. The updated introduced a regression making nsExtendCacheTime not settable. This update fixes the problem adding the cacheTime feature flag. Tobias Neitzel discovered that Net-SNMP incorrectly handled certain symlinks. An attacker could possibly use this issue to access sensitive information. Various other issues were also addressed.
2cc417ea47dd6dbe894197bffb7d3374Ubuntu Security Notice 4480-1 - It was discovered that OpenStack Keystone incorrectly handled EC2 credentials. An authenticated attacker with a limited scope could possibly create EC2 credentials with escalated permissions. It was discovered that OpenStack Keystone incorrectly handled the list of roles provided with OAuth1 access tokens. An authenticated user could possibly end up with more role assignments than intended. Various other issues were also addressed.
ced71790f13db7d62bd8925fc39f9941Ubuntu Security Notice 4479-1 - It was discovered that Django, when used with Python 3.7 or higher, incorrectly handled directory permissions. A local attacker could possibly use this issue to obtain sensitive information, or escalate permissions.
e5a717807762e4eeebb4af1aa894f99aRed Hat Security Advisory 2020-3586-01 - The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Issues addressed include information leakage and out of bounds read vulnerabilities.
85cdb8a12983c50089207347db2993afUbuntu Security Notice 4478-1 - It was discovered that Python-RSA incorrectly handled certain ciphertexts. An attacker could possibly use this issue to obtain sensitive information.
9638622054d5e92db4add776c8cc9632This archive contains all of the 128 exploits added to Packet Storm in August, 2020.
7fab10a74669db57a9421a328de6095eSifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.
66c88a57ab2fdc923291df1b13bcf592
© 2020 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed