exploit the possibilities
Showing 1 - 15 of 15 RSS Feed

Files Date: 2020-10-05

GAEN Protocol Metadata Deanonymization / Risk-Score Inflation
Posted Oct 5, 2020
Authored by Stefan Marsiske

The TX Power value in the metadata in the beacon of the GAEN protocol used by the corona/contact tracing app allows for attackers to influence risk-score calculations in their favor and the same metadata can also be used to deanonymize diagnosed users based on the type of phone they are using.

tags | advisory, protocol
advisories | CVE-2020-24722
MD5 | 938f2b1f1cd1a2ea7fd541a78f8804d0
Restaurant Reservation System 1.0 SQL Injection
Posted Oct 5, 2020
Authored by b1nary

Restaurant Reservation System version 1.0 suffers from an authenticated remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 548568c89ff58e88f64b750303928c3b
Red Hat Security Advisory 2020-4176-01
Posted Oct 5, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-4176-01 - KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products.

tags | advisory
systems | linux, redhat
advisories | CVE-2020-14364
MD5 | d22d94a8cda118223d6d82812611a49d
Ubuntu Security Notice USN-4571-1
Posted Oct 5, 2020
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4571-1 - It was discovered that rack-cors did not properly handle relative file paths. An attacker could use this vulnerability to access arbitrary files.

tags | advisory, arbitrary
systems | linux, ubuntu
advisories | CVE-2019-18978
MD5 | 3792c9ba4991a2361f83302e19df622d
Ubuntu Security Notice USN-4570-1
Posted Oct 5, 2020
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4570-1 - It was discovered that urllib3 incorrectly handled certain character sequences. A remote attacker could possibly use this issue to perform CRLF injection.

tags | advisory, remote
systems | linux, ubuntu
advisories | CVE-2020-26137
MD5 | 94d0262eabdbd307023dc56562e3ca2e
Ubuntu Security Notice USN-4568-1
Posted Oct 5, 2020
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4568-1 - It was discovered that Brotli incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash.

tags | advisory
systems | linux, ubuntu
advisories | CVE-2020-8927
MD5 | cd338bab79a09cb37fa2330bc5282b74
SpamTitan 7.07 Remote Code Execution
Posted Oct 5, 2020
Authored by Felipe Molina

SpamTitan version 7.07 suffers from an unauthenticated remote code execution vulnerability in snmp-x.php.

tags | exploit, remote, php, code execution
advisories | CVE-2020-11698
MD5 | a3dbab90c996c6fb7053300bdca18311
RocketLinx Series Authentication Bypass / CSRF / Command Injection
Posted Oct 5, 2020
Authored by T. Weber | Site sec-consult.com

RocketLinx Series suffers from unauthenticated device administration, backdoor account, cross site request forgery, command injection, and unauthenticated tftp action vulnerabilities. Multiple versions are affected.

tags | advisory, vulnerability, csrf
advisories | CVE-2020-12500, CVE-2020-12501, CVE-2020-12502, CVE-2020-12503, CVE-2020-12504
MD5 | 9664ca8388506a40ebc5918326533f75
Ubuntu Security Notice USN-4569-1
Posted Oct 5, 2020
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4569-1 - It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity injection attack. It was discovered that Yaws mishandled certain input when running CGI scripts. A remote attacker could use this vulnerability to execute arbitrary commands.

tags | advisory, remote, arbitrary, cgi
systems | linux, ubuntu
advisories | CVE-2020-24379, CVE-2020-24916
MD5 | b57e1fe6c87cc3eebc0b2bd7a99b1ee1
Red Hat Security Advisory 2020-4174-01
Posted Oct 5, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-4174-01 - MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL.

tags | advisory
systems | linux, redhat
advisories | CVE-2019-2614, CVE-2019-2627, CVE-2019-2628, CVE-2019-2737, CVE-2019-2739, CVE-2019-2740, CVE-2019-2758, CVE-2019-2805, CVE-2019-2938, CVE-2019-2974, CVE-2020-13249, CVE-2020-2574, CVE-2020-2752, CVE-2020-2760, CVE-2020-2780, CVE-2020-2812, CVE-2020-2814, CVE-2020-2922
MD5 | 1b1f359a1928681ebd0f4791f9680247
Red Hat Security Advisory 2020-4173-01
Posted Oct 5, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-4173-01 - The jackson-databind package provides general data-binding functionality for Jackson, which works on top of Jackson core streaming API.

tags | advisory
systems | linux, redhat
advisories | CVE-2020-24750
MD5 | d2c5c03024d2ec3c0f208032ef828dc5
GRR 3.4.2.3
Posted Oct 5, 2020
Authored by Andreas Moser, Mikhail Bushkov, Ben Galehouse, Milosz Lakomy | Site github.com

GRR Rapid Response is an incident response framework focused on remote live forensics. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely. GRR consists of 2 parts: client and server. GRR client is deployed on systems that one might want to investigate. On every such system, once deployed, GRR client periodically polls GRR frontend servers for work. "Work" means running a specific action: downloading file, listing a directory, etc. GRR server infrastructure consists of several components (frontends, workers, UI servers) and provides web-based graphical user interface and an API endpoint that allows analysts to schedule actions on clients and view and process collected data.

Changes: Reference documentation and an OpenAPI spec is now available for the GRR API. Timeline collection flow now also collects the file creation timestamp on all platforms. Various other updates and improvements.
tags | tool, remote, web, forensics
systems | unix
MD5 | 6f340d45372ed83e85217d6573df0257
SQLMAP - Automatic SQL Injection Tool 1.4.10
Posted Oct 5, 2020
Authored by Bernardo Damele | Site sqlmap.sourceforge.net

sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.

Changes: Bug fixes.
tags | tool, web, overflow, arbitrary, vulnerability, sql injection
systems | unix
MD5 | e8ef8c77d9d611ea17e512c84da77716
Red Hat Security Advisory 2020-4172-01
Posted Oct 5, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-4172-01 - The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Issues addressed include a code execution vulnerability.

tags | advisory, code execution
systems | linux, redhat
advisories | CVE-2020-10713, CVE-2020-14364
MD5 | 7698deb0caf019d910b610e071019288
Red Hat Security Advisory 2020-4167-01
Posted Oct 5, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-4167-01 - KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Issues addressed include a memory leak vulnerability.

tags | advisory, memory leak
systems | linux, redhat
advisories | CVE-2019-20382, CVE-2020-14364
MD5 | d35c6413c3fecfc3f8c5c97fdc211b36
Page 1 of 1
Back1Next

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    18 Files
  • 22
    Oct 22nd
    10 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close