Red Hat Security Advisory 2018-1195-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 66.0.3359.117. Issues addressed include buffer overflow, bypass, remote shell upload, and use-after-free vulnerabilities.
1f2281c68c5837e3f5afd511d38bf5daThis Metasploit module exploits an authentication bypass vulnerability in the infosvr service running on UDP port 9999 on various ASUS routers to execute arbitrary commands as root. This Metasploit module launches the BusyBox Telnet daemon on the port specified in the TelnetPort option to gain an interactive remote shell. This Metasploit module was tested successfully on an ASUS RT-N12E with firmware version 2.0.0.35. Numerous ASUS models are reportedly affected, but untested.
0b841685aaa09cefb0a9621293d64a94Digital Guardian Management Console version 7.1.2.0015 suffers from a shell upload vulnerability that allows for remote code execution.
8bc838600cd56915e5e0d27198d67ab7Debian Linux Security Advisory 4167-1 - A buffer-overflow vulnerability was discovered in Sharutils, a set of utilities handle Shell Archives. An attacker with control on the input of the unshar command, could crash the application or execute arbitrary code in the its context.
f45edf0e1ca9bff52faa495942d41a56Debian Linux Security Advisory 4149-1 - Charles Duffy discovered that the Commandline class in the utilities for the Plexus framework performs insufficient quoting of double-encoded strings, which could result in the execution of arbitrary shell commands.
a87c86c6e125862540db4cdd0f7ccf12Debian Linux Security Advisory 4146-1 - Charles Duffy discovered that the Commandline class in the utilities for the Plexus framework performs insufficient quoting of double-encoded strings, which could result in the execution of arbitrary shell commands.
2c815b04a5e19aa066ea2366b9c74efcVehicle Sales Management System suffers from cross site scripting, shell upload, and remote SQL injection vulnerabilities.
7d59495ebc82f63f150cf2a13a37aed8Gentoo Linux Security Advisory 201803-4 - A vulnerability in Newsbeuter may allow remote attackers to execute arbitrary shell commands. Versions less than or equal to 2.9-r3 are affected.
13f887fee8686b564e52d56a034342e4Debian Linux Security Advisory 4134-1 - Bjorn Bosselmann discovered that the umount bash completion from util-linux does not properly handle embedded shell commands in a mountpoint name. An attacker with rights to mount filesystems can take advantage of this flaw for privilege escalation if a user (in particular root) is tricked into using the umount completion while a specially crafted mount is present.
739295b248b871432986dbfe7125e245This Metasploit module sends a magic packet to a NETGEAR device to enable telnetd. Upon successful connect, a root shell should be presented to the user.
a7246c6e4e3c5142a9103cda8aa6e9d7Joomla! Proclaim component version 9.1.1 suffers from a remote shell upload vulnerability.
e4b3f4730e22f3b7318737ee5628509eRootkit Hunter scans files and systems for known and unknown rootkits, backdoors, and sniffers. The package contains one shell script, a few text-based databases, and optional Perl modules. It should run on almost every Unix variety except Solaris and NetBSD.
54762d04ec7faa0736cc151271b02c06168 bytes small tcp/4444 shell-binding and IP controlled (192.168.1.190) null-free Linux/ARM shellcode.
e2400f0b4e82d6ae3fb4db72afd681e6Debian Linux Security Advisory 4116-1 - Krzysztof Sieluzycki discovered that the notifier for removable devices in the KDE Plasma workspace performed insufficient sanitization of FAT/VFAT volume labels, which could result in the execution of arbitrary shell commands if a removable device with a malformed disk label is mounted.
8bfe9448284b074dff9a1fabba58ddf3136 bytes small Linux/x64 bind TCP (4444/TCP) shell (/bin/sh) + password (1234567) shellcode.
d05f6f0b7a7909402854121ee144dd64Joomla! Jimtawl component version 2.2.5 suffers from a remote shell upload vulnerability.
14f1e28f305715e649d2f7a55481170a80 byte small Linux/ARM reverse TCP shell (192.168.1.1:4444/TCP) null-free shellcode.
ca358c6e2e10a456f686560467fee49dRed Hat Security Advisory 2018-0223-01 - Nautilus is the file manager and graphical shell for the GNOME desktop. Security Fix: An untrusted .desktop file with executable permission set could choose its displayed name and icon, and execute commands without warning when opened by the user. An attacker could use this flaw to trick a user into opening a .desktop file disguised as a document, such as a PDF, and execute arbitrary commands. Note: This update will change the behavior of Nautilus. Nautilus will now prompt the user for confirmation when executing an untrusted .desktop file for the first time, and then add it to the trusted file list. Desktop files stored in the system directory, as specified by the XDG_DATA_DIRS environment variable, are always considered trusted and executed without prompt.
f0e110126554a5d70a7a6de9496a29e7Toplist 2 suffers from remote shell upload, backdoor account, and remote SQL injection vulnerabilities.
08a6531a217a4c307ef90f734313edb8156 bytes small Linux/ARM password protected reverse TCP (192.168.1.1:4444/TCP) shell (/bin/sh) null-free shellcode.
b7131d0642486647b97ab38932c932e3Gentoo Linux Security Advisory 201801-18 - Insufficient input validation in Newsbeuter may allow remote attackers to execute arbitrary shell commands. Versions less than 2.9-r3 are affected.
2e41bd1176e5ce1d057f0ab9c5760f96Belkin N600DB suffers from password disclosure, a backdoor shell, server-side request forgery, and command injection vulnerabilities.
546c8e10d2e3c9868c52f837366e622cD-Link DNS-325 ShareCenter versions 1.05B03 and below suffer from remote shell upload and command injection vulnerabilities.
9b97afd3b186a9159133894550ec5482Kaseya VSA version 9.2 suffers from a remote shell upload vulnerability.
907b91ed2f652a5d04feabc0ab331cb0Disk Pulse Enterprise version 10.1.18 buffer overflow exploit that binds a shell.
70ce17cbe1db3948f132073f7d0feee7
© 2018 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed