what you don't know can hurt you
Showing 1 - 25 of 33 RSS Feed

Files

Typesetter CMS 5.1 Remote Code Execution
Posted Oct 7, 2020
Authored by Rodolfo Tavares | Site tempest.com.br

Typesetter version 5.1 is vulnerable to code execution via /index.php/Admin/Uploaded. An attacker can exploit this by uploading a zip that contains a malicious php file inside. After extracting the zip file containing the malicious php file, it is possible to execute commands on the target operation system.

tags | advisory, php, code execution
advisories | CVE-2020-25790
MD5 | 5524c94291b9260c89573ff9a567213e

Related Files

Typesetter CMS 5.1 Remote Code Execution
Posted Oct 20, 2020
Authored by Rodolfo Tavares

Typesetter CMS version 5.1 authenticated remote code execution exploit.

tags | exploit, remote, code execution
advisories | CVE-2020-25790
MD5 | be124f8d98baac1116395606bbbfd43c
Typesetter CMS 5.1 Cross Site Scripting
Posted Oct 1, 2020
Authored by Alperen Ergel

Typesetter CMS version 5.1 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 4e533bce77873c5b7b391e6d47bafceb
GilaCMS 1.11.5 Cross Site Request Forgery / Cross Site Scripting
Posted Jun 23, 2020
Authored by Rodolfo Tavares | Site tempest.com.br

GilaCMS version 1.11.5 suffers from cross site request forgery and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, csrf
advisories | CVE-2019-20803, CVE-2019-20804
MD5 | 828920573a274839d8cb79b11c4ff77e
Avast Secure Browser 76.0.1659.101 Local Privilege Escalation
Posted Mar 21, 2020
Authored by Silton Santos

A local privilege escalation issue was discovered in Avast Secure Browser version 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates.

tags | advisory, local
advisories | CVE-2019-17190
MD5 | ea6f5697a1e7a127ba2de04c3e0ae95f
Piwigo 2.9.5 Cross Site Request Forgery / Cross Site Scripting
Posted Sep 13, 2019
Authored by Rodolfo Tavares

Piwigo version 2.9.5 suffers from cross site request forgery and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, csrf
advisories | CVE-2019-13363, CVE-2019-13364
MD5 | 3c7069e96e000fdbcb03ee3f7ec38aed
Typesetter 5.1 Cross Site Scripting
Posted Dec 5, 2018
Authored by Mithat Gogebakan | Site netsparker.com

Typesetter version 5.1 suffers from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | 1816367e52467af90ad6a1ced2ce4278
G DATA TOTAL SECURITY 25.4.0.3 Active-X Buffer Overflow
Posted Jul 13, 2018
Authored by Felipe Xavier Oliveira

G DATA TOTAL SECURITY version 25.4.0.3 suffers from an active-x buffer overflow vulnerability.

tags | exploit, overflow, activex
advisories | CVE-2018-10018
MD5 | 90c8424162c88e3a300d66cb5666405a
Total AV 4.6.19 Insecure Permissions
Posted Jul 13, 2018
Authored by Felipe Xavier Oliveira

A vulnerability allows local attackers to escalate privilege on TotalAV versions 4.1.7 through 4.6.19 because of weak "C:\Program Files\TotalAV" permissions. The specific flaw exists within the access control that is set and modified during the installation of the product. The product sets weak access control restrictions. An attacker can leverage this vulnerability to execute arbitrary code under the context of Administrator, the IUSR account, or SYSTEM.

tags | exploit, arbitrary, local
advisories | CVE-2018-5313
MD5 | faa27411003777a314b1bfe60253a563
ISS For Business 14.0.1400.2029 Blue Screen Of Death
Posted Jul 13, 2018
Authored by Felipe Xavier Oliveira

In MicroWorld eScan Internet Security Suite (ISS) for Business version 14.0.1400.2029, the driver econceal.sys allows a non-privileged user to send a 0x830020E0 IOCTL request to \\.\econceal to cause a denial of service (BSOD).

tags | advisory, denial of service
advisories | CVE-2018-10018, CVE-2018-10098
MD5 | e43f0732680669dac8762679657968d3
Panda Global Security 17.0.1 NULL DACL Grants Full Access
Posted Mar 8, 2018
Authored by Felipe Xavier Oliveira

Panda Global Security version 17.0.1 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through the use of an insecurely created named pipe.

tags | exploit, denial of service, local
advisories | CVE-2018-6322
MD5 | 78a633d42e79810dad6911634f7b45e9
WPS Free Office 10.2.0.5978 NULL DACL Grants Full Access
Posted Mar 8, 2018
Authored by Felipe Xavier Oliveira

WPS Free Office version 10.2.0.5978 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through the use of an insecurely created named pipe.

tags | exploit, denial of service, local
advisories | CVE-2018-6400
MD5 | 9632d24c8cfec8d732dcac81951c9a47
Panda Global Security 17.0.1 Unquoted Service Path
Posted Mar 8, 2018
Authored by Felipe Xavier Oliveira

Panda Global Security version 17.0.1 suffers from an unquoted service path vulnerability.

tags | exploit
advisories | CVE-2018-6321
MD5 | 13cfd6979af78b1bf0f9385013a7115d
BitDefender Total Security 2018 Insecure Pipe Permissions
Posted Mar 8, 2018
Authored by Felipe Xavier Oliveira

BitDefender Total Security 2018 suffers from an insecure pipe permissions vulnerability.

tags | advisory
advisories | CVE-2018-6183
MD5 | 9677f45e40c72ee291b90a48afee28cf
10-Strike Network Monitor 5.4 Unquoted Service Path
Posted Mar 8, 2018
Authored by Felipe Xavier Oliveira

10-Strike Network Monitor version 5.4 suffers from an unquoted service path vulnerability.

tags | exploit
advisories | CVE-2018-6016
MD5 | 76d354f866dec2773e1d08ee03b36139
Hola VPN 1.79.859 Insecure Service Permissions
Posted Mar 8, 2018
Authored by Felipe Xavier Oliveira

Hola VPN version 1.79.859 suffers from an insecure service permission vulnerability.

tags | exploit
advisories | CVE-2018-6623
MD5 | 1876f7351ffbf17ac8b728051bcb8ddc
Rapid Scada 5.5.0 Insecure Permissions
Posted Mar 6, 2018
Authored by Felipe Xavier Oliveira

Rapid Scada version 5.5.0 suffers from an insecure permission vulnerability.

tags | exploit
advisories | CVE-2018-5313
MD5 | c81b2a59f24e59822c91601bace1421d
TypeSetter CMS 5.1 Cross Site Request Forgery
Posted Feb 14, 2018
Authored by Navina Asrani

TypeSetter CMS version 5.1 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
advisories | CVE-2018-6888
MD5 | c3781a44eff5184539eb3e3e64a5512f
TypeSetter CMS 5.1 Host Header Injection
Posted Feb 13, 2018
Authored by Navina Asrani

TypeSetter CMS version 5.1 suffers from a host header injection vulnerability.

tags | exploit
advisories | CVE-2018-6889
MD5 | 79728f4462823cdf8b70681c903c52e5
TSiteBuilder 1.0 SQL Injection
Posted Jan 28, 2018
Authored by Ihsan Sencan

TSiteBuilder version 1.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 496b92a8e463e0e72fd600a2082013e6
Handy Password 4.9.3 Buffer Overflow
Posted Jan 11, 2018
Authored by Felipe Xavier Oliveira

Tempest Security Intelligence ADV-12/2018 - A buffer overflow in Handy Password version 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action.

tags | advisory, remote, overflow, arbitrary
MD5 | 7353f4100afbf7c53aa46495663168d5
Sync Breeze 10.1.16 Buffer Overflow
Posted Oct 31, 2017
Authored by Felipe Xavier Oliveira

Sync Breeze version 10.1.16 is vulnerable to a buffer overflow vulnerability, which can be exploited remotely or locally to achieve arbitrary code execution. The flaw is triggered by providing a long input into the "Destination directory" path of the application.

tags | advisory, overflow, arbitrary, code execution
advisories | CVE-2017-15950
MD5 | f4f002630a2eed34a39911ef0c7be183
Ghost Blog 0.11.3 Cross Site Scripting
Posted Jan 20, 2017
Authored by Patrick Costa

Tempest Security Intelligence Advisory ADV-9/2017 - Ghost Blog version 0.11.3 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | be5b3a306042b6294633f1d980b7b7ab
Atlassian Jira 7.1.7 Cross Site Scripting
Posted Jan 17, 2017
Authored by Roberto Soares

Tempest Security Intelligence Advisory ADV-2/2016 - Atlassian Jira version 7.1.7 suffers from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2016-6285
MD5 | e6472969a5940d87f287d0be2baf9fe3
Atlassian Confluence 5.9.12 Cross Site Scripting
Posted Jan 4, 2017
Authored by Jodson Santos

Tempest Security Intelligence Advisory ADV-3/2016 - Atlassian Confluence version 5.9.12 is vulnerable to persistent cross site scripting because it fails to securely validate user controlled data, thus making it possible for an attacker to supply crafted input in order to harm users. The bug occurs at pages carrying attached files, even though the attached file name parameter is correctly sanitized upon submission, it is possible for an attacker to later edit the attached file name property and supply crafted data (i.e HTML tags and script code) without the occurrence of any security checks, resulting in an exploitable persistent cross site scripting injection.

tags | exploit, xss
advisories | CVE-2016-6283
MD5 | e811f22000dd04cc3f47ebdb47e52dfb
Telegram Desktop 0.10.1 DLL Hijacking
Posted Jan 4, 2017
Authored by Felipe Xavier Oliveira

Tempest Security Intelligence Advisory ADV-6/2016 - Telegram Desktop version 0.10.1 is vulnerable to dll hijacking as it tries to load "COMBASE.dll" without supplying the absolute path, thus relying upon the presence of such dll on the system directory.

tags | advisory
MD5 | 171558ee8417ad73202f1b8bdbaf1480
Page 1 of 2
Back12Next

File Archive:

November 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    2 Files
  • 2
    Nov 2nd
    9 Files
  • 3
    Nov 3rd
    15 Files
  • 4
    Nov 4th
    90 Files
  • 5
    Nov 5th
    22 Files
  • 6
    Nov 6th
    16 Files
  • 7
    Nov 7th
    1 Files
  • 8
    Nov 8th
    1 Files
  • 9
    Nov 9th
    40 Files
  • 10
    Nov 10th
    27 Files
  • 11
    Nov 11th
    28 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    18 Files
  • 14
    Nov 14th
    2 Files
  • 15
    Nov 15th
    2 Files
  • 16
    Nov 16th
    29 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    15 Files
  • 19
    Nov 19th
    21 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    19 Files
  • 24
    Nov 24th
    32 Files
  • 25
    Nov 25th
    7 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close