ignore security and it'll go away
Showing 76 - 100 of 7,319 RSS Feed

Web Files

Hydra Network Logon Cracker 8.6
Posted Jul 22, 2017
Authored by van Hauser, thc | Site thc.org

THC-Hydra is a high quality parallelized login hacker for Samba, Smbnt, Cisco AAA, FTP, POP3, IMAP, Telnet, HTTP Auth, LDAP, NNTP, MySQL, VNC, ICQ, Socks5, PCNFS, Cisco and more. Includes SSL support, parallel scans, and is part of Nessus.

Changes: Added radmin2 module by catatonic prime. SMB module now checks if SMBv1 is supported by the server and if signing is required. http-form module now supports URLs up to 6000 bytes. Various other updates.
tags | tool, web, imap
systems | cisco, unix
MD5 | 5d909cfea627a1f2482b82dfbd64956c
UFONet 0.9
Posted Jul 18, 2017
Authored by psy | Site ufonet.03c8.net

UFONet abuses OSI Layer 7-HTTP to create/manage 'zombies' and to conduct different attacks using GET/POST, multithreading, proxies, origin spoofing methods, cache evasion techniques, etc.

Changes: Added more "Open Redirect" dorks. Added LOIC DoS (non-DDoS) attacks. Added whois resolving. Various other updates.
tags | tool, web, denial of service, spoof
MD5 | 7540f45eb8e2d3881f8d17e9a638987a
Sophos Web Appliance 4.3.0.2 Remote Command Injection
Posted Jul 18, 2017
Authored by Russell Sanford

Sophos Web Appliance version 4.3.0.2 reporting JSON trafficType remote command injection exploit.

tags | exploit, remote, web
advisories | CVE-2017-6182
MD5 | 6d5a691d22205e8d640310d8376287ce
Easy File Sharing Web Server 7.2 Buffer Overflow
Posted Jul 16, 2017
Authored by N_A

Easy File Sharing Web Server version 7.2 SEH buffer overflow PassWD exploit that spawns a reverse shell.

tags | exploit, web, overflow, shell
MD5 | 0a226fb9ae5920b89126ab6486e607fb
Windows Browser Example Exploit
Posted Jul 15, 2017
Authored by sinn3r | Site metasploit.com

This template covers IE8/9/10, and uses the user-agent HTTP header to detect the browser version. Please note IE8 and newer may emulate an older IE version in compatibility mode, in that case the module won't be able to detect the browser correctly. This is an example Metasploit module to be used for exploit development.

tags | exploit, web
MD5 | faa8b809be83a6b1aea60f69ecb52ffc
Debian Security Advisory 3908-1
Posted Jul 14, 2017
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3908-1 - An integer overflow has been found in the HTTP range module of Nginx, a high-performance web and reverse proxy server, which may result in information disclosure.

tags | advisory, web, overflow, info disclosure
systems | linux, debian
advisories | CVE-2017-7529
MD5 | 2d367b8f14fc73b9768c34d3df9ea843
EMC Undocumented Accounts
Posted Jul 12, 2017
Authored by rgod | Site emc.com

EMC ViPR SRM, EMC Storage M and R, EMC VNX M and R, EMC M and R for SAS Solution Packs contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system.

tags | advisory, remote, web, arbitrary
advisories | CVE-2017-8011
MD5 | d7658f06bf5a32b13365a7b0df94c860
Red Hat Security Advisory 2017-1731-01
Posted Jul 12, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1731-01 - The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 26.0.0.137. Security Fix: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.

tags | advisory, web, arbitrary, vulnerability
systems | linux, redhat
advisories | CVE-2017-3080, CVE-2017-3099, CVE-2017-3100
MD5 | 32cef9657a3ce726d633e0dba2951591
Red Hat Security Advisory 2017-1721-01
Posted Jul 12, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1721-01 - The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix: It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning.

tags | advisory, remote, web, protocol
systems | linux, redhat
advisories | CVE-2016-8743
MD5 | fc524626b25012e84611eccacaa89fdf
Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal
Posted Jul 11, 2017
Authored by LiquidWorm | Site zeroscience.mk

Pelco VideoXpert suffers from a directory traversal vulnerability. Exploiting this issue will allow an unauthenticated attacker to view arbitrary files within the context of the web server.

tags | exploit, web, arbitrary
MD5 | dfa0df3c855819b71c9869725eccb056
Schneider Electric Pelco Sarix/Spectra Cameras CSRF Enable SSH Root Access
Posted Jul 11, 2017
Authored by LiquidWorm | Site zeroscience.mk

Pelco IP cameras suffer from a cross site request forgery vulnerability. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

tags | exploit, web, csrf
MD5 | 7cab066459f46bedf6175289966aec2e
Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

The Barracuda WAF management application transmits the current user and session identifier over HTTP GET. Firmware version 8.0.1.014 is affected.

tags | exploit, web
MD5 | 6a4ac3abbfee6355517319f7d35839ce
Barracuda WAF V360 Firmware 8.0.1.014 Credential Disclosure
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

Firmware reversing of the Barracuda Web Application Firewall uncovered development artifacts that should have been removed on the production images. Once the encryption scheme was broken, many QA and development tools were discovered on the affected partitions. Some of these contained sensitive information such as authentication credentials used by internal developers. Firmware version 8.0.1.014 is affected.

tags | exploit, web
MD5 | 294601501b6c14d834d8d86848392759
Barracuda WAF V360 Firmware 8.0.1.014 Early Boot Root Shell
Posted Jul 6, 2017
Authored by Matthew Bergin, Joshua Hardin | Site korelogic.com

Firmware reversing of the Barracuda Web Application Firewall uncovered debug features that should have been removed on the production images. Appending a debugging statement onto a grub configuration line leads to an early boot root shell. Firmware version 8.0.1.014 is affected.

tags | exploit, web, shell, root
MD5 | f6f41f262997fb113e39f15d6d42c39c
Red Hat Security Advisory 2017-1712-01
Posted Jul 6, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1712-01 - Red Hat 3scale API Management Platform 2.0 is a platform for the management of access and traffic for web-based APIs across a variety of deployment options. Security Fix: It was found that RH-3scale AMP would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. The underlying container image was also rebuilt to resolve other security issues.

tags | advisory, web
systems | linux, redhat
advisories | CVE-2017-1000364, CVE-2017-1000366, CVE-2017-7502, CVE-2017-7512
MD5 | 956dddcd24d616d3e3eb9855a25dca7e
Lepide Auditor Suite Remote Code Execution
Posted Jul 5, 2017
Authored by mr_me

Lepide Auditor Suite suffers from a createdb() web console database injection remote code execution vulnerability.

tags | exploit, remote, web, code execution
MD5 | c321780097e33a5c5eef179bd4d418c0
BOA Web Server 0.94.14rc21 Arbitrary File Access
Posted Jul 3, 2017
Authored by Miguel Mendez Z

BOA Web Server version 0.94.14rc21 an arbitrary file access vulnerability.

tags | exploit, web, arbitrary
advisories | CVE-2017-9833
MD5 | aaea3bb5ba1b420b9f8f2471697656b2
Bettercap 1.6.1
Posted Jun 30, 2017
Authored by evilsocket | Site bettercap.org

BetterCAP is a powerful, flexible, and portable tool created to perform various types of MITM attacks against a network, manipulate HTTP, HTTPS and TCP traffic in realtime, sniff for credentials and much more.

Changes: Huge improvement on HTTPS parser, now it parses TLS Client Hello messages with SNI extension in order to extract the real hostname. Removed IPv6 specific options, use of IPv6 is automatically detected now. Updated BSD firewall manager to support IPv6 forwarding. IPv6 port redirection option. Various other updates and improvements.
tags | tool, web, sniffer, tcp
systems | unix
MD5 | 3652340784b3aea6917af77f803c7e7e
Easy File Sharing Web Server 7.2 Account Import Buffer Overflow
Posted Jun 30, 2017
Authored by Chako

Easy File Sharing Web Server version 7.2 suffers from an account import local buffer overflow vulnerability.

tags | exploit, web, overflow, local
MD5 | 3fe8d27b0bff54d459eee1a9037b30f7
Schneider Electric Wonderware InduSoft Web Studio 8.0 Patch 3 Insecure Permissions
Posted Jun 30, 2017
Authored by Karn Ganeshen

Schneider Electric Wonderware InduSoft Web Studio versions 8.0 Patch 3 and below suffer from having incorrect default permissions.

tags | exploit, web
MD5 | 2b609eb1e1a05b44853880ed5da03f26
Apache ActiveMQ 5.x Web Shell Upload
Posted Jun 29, 2017
Authored by Hillary Benson, Ian Anderson | Site metasploit.com

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

tags | exploit, remote, web, arbitrary
advisories | CVE-2016-3088
MD5 | b60822f82c2ef7d4aade4c66e6dee1e9
Red Hat Security Advisory 2017-1596-01
Posted Jun 28, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1596-01 - Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY principle. The following packages have been upgraded to a later upstream version: python-django. Security Fix: A redirect flaw, where the is_safe_url() function did not correctly sanitize numeric-URL user input, was found in python-django. A remote attacker could exploit this flaw to perform XSS attacks against the OpenStack dashboard.

tags | advisory, remote, web, python
systems | linux, redhat
advisories | CVE-2017-7233
MD5 | ccdd8eb5707b5363c19fd8d21026f1e7
Red Hat Security Advisory 2017-1601-01
Posted Jun 28, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1601-01 - Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller framework for web application development. Action Pack implements the controller and the view components. rh-ruby23-rubygem-nokogiri provides Nokogiri, which is an HTML, XML, SAX, and Reader parser. Among Nokogiri's many features is the ability to search documents using XPath or CSS3 selectors. rh-ruby23-rubygem-ovirt-engine-sdk4 provides the ruby SDK for the oVirt Engine API.

tags | advisory, web, ruby
systems | linux, redhat
advisories | CVE-2016-4457, CVE-2016-7047, CVE-2017-7497
MD5 | 445fd5cb0824cb408c522dedc70efea6
Easy File Sharing Web Server 7.2 Buffer Overflow
Posted Jun 27, 2017
Authored by clubjk

Easy File Sharing Web Server version 7.2 GET HTTP request buffer overflow exploit.

tags | exploit, web, overflow
MD5 | 8f01d366a360414c32e90e350d821ce1
Ubuntu Security Notice USN-3340-1
Posted Jun 26, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3340-1 - Emmanuel Dreyfus discovered that third-party modules using the ap_get_basic_auth_pw function outside of the authentication phase may lead to authentication requirements being bypassed. This update adds a new ap_get_basic_auth_components function for use by third-party modules. Vasileios Panopoulos discovered that the Apache mod_ssl module may crash when third-party modules call ap_hook_process_connection during an HTTP request to an HTTPS port. Various other issues were also addressed.

tags | advisory, web
systems | linux, ubuntu
advisories | CVE-2017-3167, CVE-2017-3169, CVE-2017-7668, CVE-2017-7679
MD5 | e9929f4f48d68556f27b3ffbbdf309c5
Page 4 of 293
Back23456Next

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    11 Files
  • 19
    Oct 19th
    3 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close