WhatWeb is a next-generation web scanner. WhatWeb recognizes web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognize something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more. WhatWeb supports an aggression level to control the trade off between speed and reliability.
45ca011cb9018d277ff2efeaa0ddd4f9Sysdig Falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco will notify you when these rules are violated. You can think about falco as a mix between snort, ossec and strace.
005fe8abd35154b09736dbe8f3f4ad5cThis Metasploit module exploits an incorrect side-effect modeling of the 'in' operator. The DFG compiler assumes that the 'in' operator is side-effect free, however the embed element with the PDF plugin provides a callback that can trigger side-effects leading to type confusion (CVE-2020-9850). The type confusion can be used as addrof and fakeobj primitives that then lead to arbitrary read/write of memory. These primitives allow us to write shellcode into a JIT region (RWX memory) containing the next stage of the exploit. The next stage uses CVE-2020-9856 to exploit a heap overflow in CVM Server, and extracts a macOS application containing our payload into /var/db/CVMS. The payload can then be opened with CVE-2020-9801, executing the payload as a user but without sandbox restrictions.
2dc9b201150ea12e09390643b437b269Sony IPELA Network Camera SNC-DH120T version 1.82.01 suffers from a remote stack buffer overflow vulnerability. The vulnerability is caused due to a boundary error in the processing of received FTP traffic through the FTP client functionality (ftpclient.cgi), which can be exploited to cause a stack-based buffer overflow when a user issues a POST request to connect to a malicious FTP server. Successful exploitation could allow execution of arbitrary code on the affected device or cause denial of service scenario.
f3c26902b184bef531fb09e991e41a65The Call For Papers for nullcon Goa 2021 is now open. Nullcon is an information security conference held in Goa, India. The focus of the conference is to showcase the next generation of offensive and defensive security technology. It will take place in March of 2021.
2195e33b7b03998a600766bbee7f995eBrightSign Digital Signage Diagnostic Web Server version 8.2.26 suffers from an unauthenticated server-side request forgery vulnerability.
296bf65f30621b25981d6cb6556e0e99SpinetiX Fusion Digital Signage version 3.4.8 suffers from an authenticated path traversal vulnerability. Input passed via several parameters in index.php script is not properly verified before being used to create and delete files. This can be exploited to write backup files to an arbitrary location and/or delete arbitrary files via traversal attacks.
7f728d906bc879ebc132cb19c060a6c2SpinetiX Fusion Digital Signage version 3.4.8 suffers from a database backup disclosure vulnerability.
bd78c5ac803733307c42b810b4232217vPrioritizer enables users to understand the contextualized risk (vPRisk) on an asset-vulnerability relationship level across the organization by considering factors like base CVSS, asset accessibility, criticality, exploit availability, business sensitivity, and more. It helps teams to make more informed decisions about vulnerability remediation for assets.
bf7a2d1713056e78aff66ea51692bd37Red Hat Security Advisory 2020-4158-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.3.1. Issues addressed include cross site scripting, spoofing, and use-after-free vulnerabilities.
827e1a5da8d10f6dbeeb209a33d11857Red Hat Security Advisory 2020-4155-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.3.1. Issues addressed include cross site scripting, spoofing, and use-after-free vulnerabilities.
aacf570a0d7359baef5456ced0459fabRed Hat Security Advisory 2020-4154-01 - AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. This release of Red Hat AMQ Broker 7.4.5 serves as a replacement for Red Hat AMQ Broker 7.4.4, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include a server-side request forgery vulnerability.
1819629c6979685119003fa4303f3ea5Ubuntu Security Notice 4562-1 - It was discovered that kramdown insecurely handled certain crafted input. An attacker could use this vulnerability to read restricted files or execute arbitrary code.
ebf1cdf60c7f8611d34ce58ab46f6a1cCMS Made Simple version 2.2.14 suffers from a persistent cross site scripting vulnerability.
14c110a6cceaf089f3be6a38ce75132fGetSimple CMS version 3.3.16 suffers from a persistent cross site scripting vulnerability.
caeda6040e0c1a7359c77eb390f487b7SpinetiX Fusion Digital Signage version 3.4.8 suffers from a cross site request forgery vulnerability.
b11d34cdcd9290c7637a7fddb59c490cRed Hat Security Advisory 2020-3842-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
4ab5857c889c0d682750dcccd6c146bcMonoCMS Blog version 1.0 suffers from arbitrary file deletion, cross site request forgery, and information disclosure vulnerabilities.
858c4bad79460948ebff42b9ed1fd0cdRed Hat Security Advisory 2020-4157-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.3.1. Issues addressed include cross site scripting, spoofing, and use-after-free vulnerabilities.
fbc368cc259850be2d116bf10aa8ef7aSpinetiX Fusion Digital Signage versions 3.4.8 and below suffer from a username enumeration vulnerability.
0f397d0c453903fc6da9856dc936c6ebRed Hat Security Advisory 2020-4156-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.3.1. Issues addressed include cross site scripting, spoofing, and use-after-free vulnerabilities.
2f878bb9f01f845d1d0b90021e38dfe5WebsiteBaker version 2.12.2 suffers from an authenticated remote SQL injection vulnerability.
4f52a219a3daa8ad4fe1365adb54ff13Ubuntu Security Notice 4561-1 - It was discovered that Rack incorrectly handled certain paths. An attacker could possibly use this issue to obtain sensitive information. It was discovered that Rack incorrectly validated cookies. An attacker could possibly use this issue to forge a secure cookie.
1647278df1e467bf98dbfb76e8bf528fTypesetter CMS version 5.1 suffers from a persistent cross site scripting vulnerability.
4e533bce77873c5b7b391e6d47bafcebThis archive contains all of the 97 exploits added to Packet Storm in September, 2020.
8bff91c2fd6e647efe368395365ada91
© 2020 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed