exploit the possibilities
Showing 1 - 19 of 19 RSS Feed

Files Date: 2021-01-12

GNU Privacy Guard 2.2.27
Posted Jan 12, 2021
Site gnupg.org

GnuPG (the GNU Privacy Guard or GPG) is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant to be compatible with PGP from NAI, Inc. Because it does not use any patented algorithms, it can be used without any restrictions.

Changes: Fixed --gpgconf-list case with no conf files at all. Fixed description of two new options. Minor permission fix in wkd for created files.
tags | tool, encryption
MD5 | a9c002b5356103c97412955a1956ae0c
Cloud Filter Arbitrary File Creation / Privilege Escalation
Posted Jan 12, 2021
Authored by Grant Willcox, James Foreshaw | Site metasploit.com

This Metasploit module exploits a vulnerability in cldflt.sys. The Cloud Filter driver on Windows 10 v1803 and later, prior to the December 2020 updates, did not set the IO_FORCE_ACCESS_CHECK or OBJ_FORCE_ACCESS_CHECK flags when calling FltCreateFileEx() and FltCreateFileEx2() within its HsmpOpCreatePlaceholders() function with attacker controlled input. This meant that files were created with KernelMode permissions, thereby bypassing any security checks that would otherwise prevent a normal user from being able to create files in directories they don't have permissions to create files in. This module abuses this vulnerability to perform a DLL hijacking attack against the Microsoft Storage Spaces SMP service, which grants the attacker code execution as the NETWORK SERVICE user. Users are strongly encouraged to set the PAYLOAD option to one of the Meterpreter payloads, as doing so will allow them to subsequently escalate their new session from NETWORK SERVICE to SYSTEM by using Meterpreter's "getsystem" command to perform RPCSS Named Pipe Impersonation and impersonate the SYSTEM user.

tags | exploit, code execution
systems | windows
advisories | CVE-2020-1170, CVE-2020-17136
MD5 | a3096153d5abb79b42ddbd4fd922a273
WordPress AIT CSV Import/Export 3.0.3 Shell Upload
Posted Jan 12, 2021
Authored by h00die | Site metasploit.com

WordPress AIT CSV Import/Export plugin versions 3.0.3 and below allow unauthenticated remote attackers to upload and execute arbitrary PHP code. The upload-handler does not require authentication, nor validates the uploaded content. It may return an error when attempting to parse a CSV, however the uploaded shell is left. The shell is uploaded to wp-content/uploads/. The plugin is not required to be activated to be exploitable.

tags | exploit, remote, arbitrary, shell, php
MD5 | c39ac90e0b404ac71d25decc4f495aec
Flawfinder 2.0.15
Posted Jan 12, 2021
Authored by David A. Wheeler | Site sourceforge.net

Flawfinder searches through source code for potential security flaws, listing potential security flaws sorted by risk, with the most potentially dangerous flaws shown first. This risk level depends not only on the function, but on the values of the parameters of the function.

Changes: Fixed some release problems in 2.0.14. Improved handling of LoadLibraryEx.
tags | tool
systems | unix
MD5 | fca72a4b9aa51833442f8ffaebd05f19
Red Hat Security Advisory 2021-0083-01
Posted Jan 12, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-0083-01 - The rhceph-4.2 image is based on Red Hat Ceph Storage 4.2 and Red Hat Enterprise Linux. Issues addressed include a server-side request forgery vulnerability.

tags | advisory
systems | linux, redhat
advisories | CVE-2020-13379, CVE-2020-1971, CVE-2020-24659
MD5 | 74da0a08cadcdfa9af4155c688dd68e3
Ubuntu Security Notice USN-4689-2
Posted Jan 12, 2021
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4689-2 - USN-4689-1 fixed vulnerabilities in the NVIDIA graphics drivers. This update provides the corresponding updates for the NVIDIA Linux DKMS kernel modules. It was discovered that the NVIDIA GPU display driver for the Linux kernel contained a vulnerability that allowed user-mode clients to access legacy privileged APIs. A local attacker could use this to cause a denial of service or escalate privileges. Various other issues were also addressed.

tags | advisory, denial of service, kernel, local, vulnerability
systems | linux, ubuntu
advisories | CVE-2021-1052, CVE-2021-1053, CVE-2021-1056
MD5 | 5400659ba37710eaa6b249f1d24c9de7
Blind SSRF With Shellshock Exploitation
Posted Jan 12, 2021
Authored by Hardik Tyagi, Aman Saxena

Whitepaper called Blind SSRF with Shellshock Exploitation. It discusses how an attacker can leverage shellshock to also perform server-side request forgery attacks.

tags | paper
MD5 | 98b9ca178b7a872b9ca5107e78efa8e8
Gila CMS 2.0.0 Remote Code Execution
Posted Jan 12, 2021
Authored by Selim Enes Karaduman

Gila CMS version 2.0.0 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
MD5 | 9f905fd1f22c5584b0c7e5d809cb7793
Red Hat Security Advisory 2021-0081-01
Posted Jan 12, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-0081-01 - Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. The ceph-ansible package provides Ansible playbooks for installing, maintaining, and upgrading Red Hat Ceph Storage. This package contains a new implementation of the original libtirpc, transport-independent RPC library for NFS-Ganesha. NFS-GANESHA is a NFS Server running in user space. It comes with various back-end modules provided as shared objects to support different file systems and name-spaces.

tags | advisory
systems | linux, redhat
advisories | CVE-2020-25660, CVE-2020-25677, CVE-2020-27781
MD5 | c068aca7baa10eb0923b7197118e8e69
Ubuntu Security Notice USN-4649-2
Posted Jan 12, 2021
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4649-2 - USN-4649-1 fixed vulnerabilities in xdg-utils. That update caused a regression by removing the --attach functionality in thunderbird and others applications. This update fix the problem by reverting these changes. Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information. Various other issues were also addressed.

tags | advisory, vulnerability
systems | linux, ubuntu
MD5 | e3181c84ebf88124fc8440988b2185ac
Cemetery Mapping And Information System 1.0 SQL Injection
Posted Jan 12, 2021
Authored by Mesut Cetin

Cemetery Mapping and Information System version 1.0 suffers from multiple remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, sql injection
MD5 | 13b51c2660d3b63bd96411a4b133e165
Red Hat Security Advisory 2021-0073-01
Posted Jan 12, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-0073-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service, kernel
systems | linux, redhat
advisories | CVE-2020-25641
MD5 | cbf6053ea78851d5ddb84cf8bd312561
A Hands-On Approach To Linux Privilege Escalation
Posted Jan 12, 2021
Authored by Tanishq Sharma, Shikhar Saxena

Whitepaper called A Hands-On Approach To Linux Privilege Escalation. This document is intended to provide multiple techniques that a pentester can use to escalate their privileges and gain access to higher roles.

tags | paper
systems | linux
MD5 | f6cf10579b31e9f8440e8a43248cd662
Ubuntu Security Notice USN-4689-1
Posted Jan 12, 2021
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4689-1 - It was discovered that the NVIDIA GPU display driver for the Linux kernel contained a vulnerability that allowed user-mode clients to access legacy privileged APIs. A local attacker could use this to cause a denial of service or escalate privileges. It was discovered that the NVIDIA GPU display driver for the Linux kernel did not properly validate a pointer received from userspace in some situations. A local attacker could use this to cause a denial of service. Various other issues were also addressed.

tags | advisory, denial of service, kernel, local
systems | linux, ubuntu
advisories | CVE-2021-1052, CVE-2021-1053, CVE-2021-1056
MD5 | 981d1a54d362e0eb1a220d6c10591e46
SmartAgent 3.1.0 Privilege Escalation
Posted Jan 12, 2021
Authored by Orion Hridoy

SmartAgent version 3.1.0 suffers from a privilege escalation vulnerability.

tags | exploit
MD5 | 07b8ed0a364728669f5a7d741a5a8c1d
Red Hat Security Advisory 2021-0072-01
Posted Jan 12, 2021
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2021-0072-01 - Red Hat OpenShift Serverless 1.9.0 is a generally available release of the OpenShift Serverless Operator. This version of the OpenShift Serverless Operator is supported on Red Hat OpenShift Container Platform version 4.5. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2020-15586, CVE-2020-16845
MD5 | 976e58ad147bf62e96cad81c98b5824c
Backdoor.Win32.Zombam.a Remote Stack Buffer Overflow
Posted Jan 12, 2021
Authored by malvuln | Site malvuln.com

Backdoor.Win32.Zombam.a malware suffers from a remote stack buffer overflow vulnerability.

tags | exploit, remote, overflow
systems | windows
MD5 | 1d4c04985317d4a19cc3d4abc3ead48f
Ubuntu Security Notice USN-4668-4
Posted Jan 12, 2021
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4668-4 - USN-4668-1 fixed a vulnerability in python-apt. This update provides the corresponding update for Ubuntu 14.04 ESM. Kevin Backhouse discovered that python-apt incorrectly handled resources. A local attacker could possibly use this issue to cause python-apt to consume resources, leading to a denial of service. Various other issues were also addressed.

tags | advisory, denial of service, local, python
systems | linux, ubuntu
advisories | CVE-2020-27351
MD5 | 547dc78aa1e891e8e1a6f4156108a0f0
Ubuntu Security Notice USN-4667-2
Posted Jan 12, 2021
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 4667-2 - USN-4667-1 fixed a vulnerability in APT. This update provides the corresponding update for Ubuntu 14.04 ESM. Kevin Backhouse discovered that APT incorrectly handled certain packages. A local attacker could possibly use this issue to cause APT to crash or stop responding, resulting in a denial of service. Various other issues were also addressed.

tags | advisory, denial of service, local
systems | linux, ubuntu
advisories | CVE-2020-27350
MD5 | b02790b890a4077db710c9e9f926d953
Page 1 of 1
Back1Next

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close