Backdoor.Win32.NinjaSpy.c suffers from a remote stack buffer overflow vulnerability. The specimen drops a DLL named "cmd.dll" under C:\WINDOWS\ which listens on both TCP ports 2003 and 2004. By sending consecutive HTTP PUT requests with large payloads of characters, we can cause buffer overflow.
400bc171e968496bf6805e3f0060696d5ec13c5f875efa99884bbebe00d20df4This Metasploit module exploits an arbitrary file upload in the WordPress wpDiscuz plugin version 7.0.4. This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable server.
187052df5b77471af6ad467ad2dc057df0f9c9a641dd2c9d116e4f60896dcc30Backdoor.Win32.Xtreme.yvp malware suffers from an insecure permissions vulnerability that can allow for privilege escalation.
d669ec11f5f4683946716bc09419f2d27c2862ffea1aea535846c71ffaa01d1fCockpit version 234 suffers from an unauthenticated server-side request forgery vulnerability.
7d5320612c3c2171833bc0f579b2434057c4c62e25ce3e66372baa4bc0bb0e83Backdoor.Win32.Agent.dcbh malware suffers from an insecure permissions vulnerability that can allow for privilege escalation.
65b717d008ad928996743eba63917d1ee7bd2a3706dde18975d4feeabd4b5f35Online Doctor Appointment System version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.
4e72a82ccdf12e6453817b1ea3a0470883ee32884e94f262834e0420bd9d8b1aWhitepaper called Practical PHP Security.
197e4ac0326bbfca74f1394ddd7a80a6c26652441548adc45d5fc3339e7c5fd7dnsrecon version 0.10.0 suffers from a CSV injection vulnerability.
2484de16c6549b81343bb9a0ce48244d651f1fbae9b77711eac1a70a6d6494b6Ubuntu Security Notice 4687-1 - A use-after-free was discovered in Firefox when handling SCTP packets. An attacker could potentially exploit this to cause a denial of service, or execute arbitrary code.
f6f6d4bb80647327a6de7e815de26093fdd003e58d138ef1b1dd715a7afd3f48ECSIMAGING PACS version 6.21.5 suffers from a remote SQL injection vulnerability.
ec26b638120831f7b4b2f8afd063f96eb0f5169a9cf988f5550e0348cb1de0b6Curfew e-Pass Management System version 1.0 suffers from a cross site scripting vulnerability.
05f9bfd9d48cf362268b8ffe1871911c831f3b3d39c1748e99d606ffeb84261dOX App Suite and OX Documents suffer from server-side request forgery and multiple cross site scripting vulnerabilities. Various versions are affected including 7.10.4 and 7.10.3.
ba8c16584bc43d579279e941f2d796ec74153f6debe5a7df85b435f86196a43cCockpit CMS versions prior to 0.6.1 suffer from a remote code execution vulnerability.
99acfe128fe581918e0f3dd4c9856740d5d3ff47b96b2b1f9ff3f56b072adaacLife Insurance Management System version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.
d11e7072e6f0bb447cf8aa647cf3bec6d19972eca9cfab38a82236c922416965WordPress Autoptimize plugin suffers from a remote shell upload vulnerability. The ao_ccss_import AJAX call does not ensure that the file provided is a legitimate zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote code execution.
6976952649b949f1c677f4557fec06bb177e699a8fe16b809dfddb9cd2ec1b25This Metasploit module exploits an unauthenticated directory traversal vulnerability in Apache Flink version 1.11.0.
79df4302ec4ea436f7e67026dddc838b8aa4610460bb6f8baa402ecd0a91ba4dEmployee Record System version 1.0 suffers from a remote shell upload vulnerability.
1f4a5de2446758fa6b5567e6d7538a9f646130b6562a5f45e210b83df76a14a3iBall-Baton WRA150N Rom-0 backup suffers from a file disclosure vulnerability.
a51ab5d5d288d862c7866e1eea33c4dcaf1a599a08d3e7c2b27ace50bbe64e9aWhitepaper called Ethical Hacking and Penetration Testing Guide. Written in Turkish.
731b7b5c2b743defdfcad78b3cb602b5d27ec0cdccd13f1989fb47027ac5ee92
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Subscribe to an RSS Feed