This is a simple proof of concept exploit for Drupal versions prior to 7.58 that demonstrate the drupalgeddon3 authenticated remote code execution vulnerability.
083d892c5eba86d29cd75e8b8e8af90103d767eb04a11f57033b9dd9088214a0Red Hat Security Advisory 2018-1249-01 - The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services Elastic Compute Cloud. With this update, the eap7-jboss-ec2-eap package has been updated to ensure compatibility with Red Hat JBoss Enterprise Application Platform 7.1.2. Issues addressed include code execution and traversal vulnerabilities.
7a99cd9fa5e7b677979d878927b072ed90031c3e2398d6e90cb46748761646c6Jfrog Artifactory versions prior to 4.16 suffer from unauthenticated arbitrary file upload and remote command execution vulnerabilities.
152a825b4c3e4e8481acf58c79f6c1d359fdb42bc26f7d136ab8976ae360c2d7Red Hat Security Advisory 2018-1248-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 7.1.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and traversal vulnerabilities.
aba26a4b4e5f75b3fe6fa3b8d6d265d70cc537d2fb70af222279bda2dcbd4f3dWordPress WP with Spritz plugin version 1.0 suffers from local and remote file inclusion vulnerabilities.
c6986cfbd78a92dae5c9a05da5db76c918141c17da17231a3ab998a61b73258dRed Hat Security Advisory 2018-1247-01 - Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 7.1.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution and traversal vulnerabilities.
e63dc4585a5fbbae9e18277f5d41fbc0419ddd4e5aa06fc7bf35ef0cb7486fe3SickRage versions prior to 2018.03.09 return clear-text credentials in HTTP responses.
4eca74b6076c68ef8dfaed89847067aaacb96f5e62b6e0dd9c02340a7fcaca16Ubuntu Security Notice 3629-2 - USN-3629-1 fixed a vulnerability in MySQL. This update provides the corresponding update for Ubuntu 12.04 ESM. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 5.5.60 in Ubuntu 12.04 ESM. Various other issues were also addressed.
7cd6c524f3ee8ff89432a487e67dc771bd48070b403b7b5041c37c864b801bb8October CMS User plugin version 1.4.5 suffers from a persistent cross site scripting vulnerability.
2542351c0db2686c16ac211c741d58a6096bc2da3e0f49b94409072994f16c19Apple Security Advisory 2018-04-24-3 - Safari 11.1 is now available and addresses code execution vulnerabilities.
67e25f6ebc791a2bbd24e5bb509652ae33c2f36c2e7e71ca7ac3f897837be512Apple Security Advisory 2018-04-24-2 - Security Update 2018-001 is now available and addresses privilege escalation and UI spoofing issues.
ec64e473e482e25a015a31dcdc6b13d22812a03fd13980d52ca88bd0375cf456Apple Security Advisory 2018-04-24-1 - iOS 11.3.1 is now available and addresses code execution vulnerabilities.
3b6b031d4de4f82dc2d6116a7e6b0e34c773b3dbdc85944cef0fa376bfd2b1b6A lack of validation on cookie values allows you to login as any user on hik-connect.com and ezvizlife.com.
640d9d5b8ed635a745527703397776a5bb9f02ecdcb9b198beddb96116636e81Sitecore.NET version 8.1 suffers from a directory traversal vulnerability.
e4a706da6b29b62366f1ed365cb9f34fa7a8c59a749e0d003d626c959eb95de6HRSALE The Ultimate HRM version 1.0.2 suffers from a remote SQL injection vulnerability.
59325a4cf4859ff56febfa34f3bbcd6b4a95112c26ef20b9ab6610f87c0822b2This report documents Fusee Gelee, a coldboot vulnerability that allows full, unauthenticated arbitrary code execution from an early bootROM context via Tegra Recovery Mode (RCM) on NVIDIA's Tegra line of embedded processors. As this vulnerability allows arbitrary code execution on the Boot and Power Management Processor (BPMP) before any lock-outs take effect, this vulnerability compromises the entire root-of-trust for each processor, and allows exfiltration of secrets e.g. burned into device fuses.
d79d1da54305f414bc22e5c26a2e8ce9356d75ad9764e394b007e0bae39f34e7HRSALE The Ultimate HRM version 1.0.2 suffers from a CSV injection vulnerability.
1687a963043763348cd13d727463d2d3beb849e67926c5d0b6a37617f97f7773Blog Master Pro version 1.0 suffers from a CSV injection vulnerability.
f7fc3381ec61ed7adcf8a5a10586722b9f109264dc4e27d6d064e9358cb059a3Shopy Point of Sale version 1.0 suffers from a CSV injection vulnerability.
4c55fa34c00e4e68b792885d5838562724f935c925a9e623d4b66cac5df78149The Dell EMC Common Object Manager (ECOM) component used in multiple Dell EMC products is affected by a XML External Entity (XXE) Injection vulnerability that may potentially be exploited by malicious users to compromise the affected system.
ca38cccc3045ff5a40c220fdf2a44b66a7339f491e382df921a3922abcedc6ddGoogle Chrome V8 suffers from an arrow function scope fixing bug.
24f3824206b56675fc861c6cdc7ec310f3cd9a072873f501aa8fd3d6295dfdcaphpLiteAdmin versions 1.9.7.1 and below suffer from an authorization bypass vulnerability.
d4cdc05f789f02812006ddc2f04c93065977af3d3e13fccdee0a1147ceb6b814Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers.
711c7f01d27a8817d58277a5487cef3e3c7bab1c8caaf8f4c92aa21015b9117fSysdig falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco will notify you when these rules are violated. You can think about falco as a mix between snort, ossec and strace.
54966027b5e3d79a043dc10d668f7d819e3d980031cc481f6f9e9815d46d880eUbuntu Security Notice 3634-1 - Matthias Gerstner discovered that PackageKit incorrectly handled authentication. A local attacker could possibly use this issue to install arbitrary packages and escalate privileges.
1e05ccf9828c6f0b5cfea424876a649f19a67620fbf71de1a1dab598c487dd64
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed