Loki - Scanner for Simple Indicators of Compromise

Simple IOC Scanner Detection is based on four detection methods: 1. File Name IOC Regex match on full file path/name 2. Yara Rule Check Yara signature match on file data and process memory 3. Hash check Compares known malicious hashes MD5, SHA1, SHA256 with scanned files The Windows binary is...

PT-2015-1319

Name of the Vulnerable Software and Affected Versions KCodes NetUSB module for the Linux kernel affected versions not specified Description The issue is caused by a stack-based buffer overflow in the run init sbus function of the NetUSB driver. This can be exploited by a remote attacker using a...

Microsoft Internet Explorer Memory Corruption Vulnerability (CNVD-2015-03101)

Microsoft Internet Explorer is a WEB-based browser. An unspecified memory corruption vulnerability exists in Microsoft Internet Explorer, which could be exploited by a remote attacker to construct a malicious web page that could be parsed by the user, causing the application to crash or execute...

Epicor CRS Retail Source File Manipulation Local Command Execution Vulnerability

Epicor CRS Retail is a retail solution. Epicor CRS Retail has a security vulnerability that allows a local attacker to edit program source files and execute arbitrary commands...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the git-daemon-run package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

CVE-2015-1882

Multiple race conditions in IBM WebSphere Application Server WAS 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user...

CVE-2015-1882

Multiple race conditions in IBM WebSphere Application Server WAS 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user...

CVE-2015-1882

CVE-2015-1882 affects IBM WebSphere Application Server Liberty Profile (8.5.x) prior to 8.5.5.5. It describes multiple race conditions that let remote authenticated users gain elevated privileges by exploiting thread conflicts that execute Java code outside the configured EJB Run-as context. The ...

CVE-2015-1882: Concurrent Execution using Shared Resource with Improper Synchronization

Multiple race conditions in IBM WebSphere Application Server WAS 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user...

Linux custom execve-shellcode Encoder/Decoder

Linux custom execve-shellcode Encoder/Decoder. Shellcode exploit for linx86 platform / Followtheleader custom execve-shellcode Encoder/Decoder - Linux Intel/x86 Author: Konstantinos Alexiou /...

CVE-2015-2112

Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t5740, and t5740e devices and HP Flexible Thin Client t510, t520, t610, t620, and t820 devices allows remote authenticated users to execute arbitrary code via...

PT-2015-5696

Name of the Vulnerable Software and Affected Versions Ubuntu Upstart versions prior to 1.13.2-0ubuntu9 Description The issue allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user//upstart/sessions/. This is related to the logrotation script...

PT-2015-5243

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 2.0.5 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the order by parameter to various endpoints such as "credentials/", "inventories/", "projects/...

Ubuntu 14.04 LTS : mime-support vulnerability (USN-2453-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2453-1 advisory. Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered certain shell metacharacters in filenames. If a user or automated system were tricked...

USN-2453-1 mime-support vulnerability

Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered certain shell metacharacters in filenames. If a user or automated system were tricked into opening a file with a specially-crafted filename, a remote attacker could possibly execute arbitrary code...

USN-2453-1: mime-support vulnerability

Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered certain shell metacharacters in filenames. If a user or automated system were tricked into opening a file with a specially-crafted filename, a remote attacker could possibly execute arbitrary code...

Code injection

run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename...

mime-support Package 'run-mailcap' Command Injection Vulnerability

run-mailcap is a tool that executes a program from items in a mailcap file. run-mailcap fails to properly handle shell metacharacters in filenames, allowing an attacker to exploit a vulnerability for command injection attacks that can execute arbitrary shell commands...

PT-2015-3914

Name of the Vulnerable Software and Affected Versions Debian mime-support package versions prior to 3.52-1+deb7u1 Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. This is related to the run-mailcap in the Debian...

CVE-2014-7209: Improper Neutralization of Special Elements used in a Command

run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename...