Micro Focus Operations Bridge Reporter Unauthenticated Command Injection Exploit

This Metasploit module exploits a command injection vulnerability on login that affects Micro Focus Operations Bridge Reporter on Linux, versions 10.40 and below. It is a straight up command injection, with little escaping required, and it works before authentication. This module has been tested ...

Micro Focus Operations Bridge Reporter Unauthenticated Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Micro Focus Operations Bridge Reporter Unauthenticated Command Injection', 'Description' = %q This module exploits a command injection...

Ghimob Android Banking Trojan Targets 153 Mobile Apps

A new banking trojan has been discovered targeting Android users, with the capabilities to spy on 153 mobile apps from various banks, cryptocurrencies and exchanges. Researchers describe the banking trojan, called Ghimob, as a “full-fledged spy in your pocket” that can be accessed remotely by its...

CVE-2019-10121

eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID via the user authentication dialogue, aka HMCCU-153. This leads to automatic login as admin...

Siemens 44x-1 RNA CP Remote Administrative Action Execution

Binary data 153.prm...

Remote code execution

An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated remote code execution vulnerability. An authenticated attacker can send a specially crafted UDP packet, and execute commands on the vacuum cleaner as root. The bug is in the...

CVE-2018-10987

An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated remote code execution vulnerability. An authenticated attacker can send a specially crafted UDP packet, and execute commands on the vacuum cleaner as root. The bug is in the...

CVE-2018-10987

CVE-2018-10987 is a remote code execution flaw in the Dongguan Diqee 360 vacuum cleaners. The vulnerability resides in the UDP command 153, REQUEST_SET_WIFIPASSWD, where a crafted UDP packet can cause the device to execute a command as root ("/mnt/skyeye/mode_switch.sh %s"). An attacker must auth...

Microsoft Windows Common Log File System Driver Information Disclosure Vulnerability (3207328)

This host is missing an important security update according to Microsoft Bulletin MS16-153. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

December 2016 Security Monthly Quality Rollup for Windows Server 2012

December 2016 Security Monthly Quality Rollup for Windows Server 2012 Summary This security update resolves the following vulnerabilities in Windows Server 2012: MS16-153 Security update for common log file system driver MS16-151 Security update for Windows kernel-mode drivers MS16-149 Security...

MS16-153: Description of the security update for Common Log File System driver: December 13, 2016

None None...

December 2016 Security Monthly Quality Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1

December 2016 Security Monthly Quality Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1 Summary This security update resolves the following vulnerabilities in Windows: MS16-153 Security update for common log file system driver MS16-151 Security update for Windows kernel-mode drivers MS16-1...

Microsoft Windows CLFS Driver Information Disclosure (MS16-153: CVE-2016-7295)

An elevation of privilege vulnerability exists in the Windows Common Log File System CLFS driver of Microsoft Windows. The vulnerability is due to the way Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could run processes in an elevated...

MS16-153: Security Update for Common Log File System Driver (3207328)

The remote Windows host is missing a security update. It is, therefore, affected by an information disclosure vulnerability in the Windows Common Log File System CLFS due to improper handling of objects in memory. A local attacker can exploit this vulnerability, via a specially crafted applicatio...

MS16-153: Security update for Common Log File System driver: December 13, 2016

Resolves a vulnerability in Windows that could allow information disclosure when the Windows Common Log File System CLFS driver improperly handles objects in memory. In a local attack scenario, an attacker could exploit this vulnerability by running a specially crafted application to bypass...

openSUSE Security Update : curl (openSUSE-2016-153)

This update for curl fixes the following issues : - CVE-2016-0755: libcurl would reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer bsc962983 The following tracked bugs only affect the te...

SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:2326-1)

This update fixes the following security issues : - bsc956832 - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list - bsc956592 - xen: virtual PMU is unsupported XSA-163 - bsc956408 - CVE-2015-8339, CVE-2015-8340: xen: XENMEMexchange error handling issues XSA-1...

Amazon Linux: Security Advisory (ALAS-2013-153)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : mdadm (openSUSE-2015-153)

mdadm was updated to fix one security issue. This security issue was fixed : - CVE-2014-5220: mdcheck doesn't validate the input of mdadm --detail --export, possible command injection bnc910500. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Oracle Java Runtime Environment AWT storeImageArray Vulnerability

Added: 08/30/2013 CVE: CVE-2013-2465 BID: 60657 OSVDB: 94339 Background Java Runtime Environment JRE allows end users to run Java applications. Problem A buffer overflow vulnerability in the storeImageArray function of the Abstract Window Toolkit AWT library awt.dll allows command execution when ...