SonyPlaystation 4 (PS4) < 6.20 - WebKit Code Execution Exploit

Exploit for hardware platform in category local exploits...

CVE-2019-1606 Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1606)

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker coul...

Sony Playstation 4 (PS4) 6.20 - WebKit Code Execution (PoC)

Sony Playstation 4 PS4 6.20 - WebKit Code Execution PoC PS4 6.20 WebKit Code Execution PoC ============== This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as...

Sony Playstation 4 (PS4) < 6.20 - WebKit Code Execution (PoC)

PS4 6.20 WebKit Code Execution PoC ============== This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as well as an arbitrary object address leak in wkexploit.j...

CVE-2019-9563

In BlueMind 3.5.x before 3.5.11 Hotfix 7 and 4.x before 4.0-beta3, the contact application mishandles temporary uploads...

Nanjing Mapu Technology Co. Pocket University 1+4 Universal Program has a flawed logic vulnerability

Nanjing Mapu Technology Co. Pocket University 1+4 Universal Program is comprehensive mobile application service app. A logic flaw vulnerability exists in the Pocket University 1+4 Universal Program of Nanjing Mapu Technology Co. An attacker can exploit the vulnerability to obtain sensitive...

RHEL 7 : rhvm-appliance (RHSA-2019:0361)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0361 advisory. The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is availab...

Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - Reflected Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Jiofi 4 JMR 1140 Reflected Cross Site Scripting Exploit Author: Ronnie T Baby Contact:https://www.linkedin.com/in/ronnietbaby Vendor Homepage: www.jio.com Hardware Link: https://www.jio.com/shop/en-in/jmr-1140/p/491193574...

Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - Cross-Site Request Forgery (Admin Token Disclosure)

Exploit Title: Jiofi 4 JMR 1140 CSRF To Leak Admin Tokens to change wifi Password or Factory Reset Router Date: 12.02.2019 Exploit Author: Ronnie T Baby Contact:https://www.linkedin.com/in/ronnietbaby Vendor Homepage: www.jio.com Hardware Link: https://www.jio.com/shop/en-in/jmr-1140/p/491193574...

Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - CSRF (Admin Token Disclosure) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Jiofi 4 JMR 1140 CSRF To Leak Admin Tokens to change wifi Password or Factory Reset Router Exploit Author: Ronnie T Baby Contact:https://www.linkedin.com/in/ronnietbaby Vendor Homepage: www.jio.com Hardware Link:...

Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - Cross-Site Request Forgery (Password Disclosure)

Exploit Title: Jiofi 4 JMR 1140 CSRF To View Wi-fi Password Date: 12.02.2019 Exploit Author: Ronnie T Baby Contact:https://www.linkedin.com/in/ronnietbaby Vendor Homepage: www.jio.com Hardware Link: https://www.jio.com/shop/en-in/jmr-1140/p/491193574 Category: Hardware Wifi Router Version: JMR-11...

Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - Reflected Cross-Site Scripting

Exploit Title: Jiofi 4 JMR 1140 Reflected Cross Site Scripting Date: 12.02.2019 Exploit Author: Ronnie T Baby Contact:https://www.linkedin.com/in/ronnietbaby Vendor Homepage: www.jio.com Hardware Link: https://www.jio.com/shop/en-in/jmr-1140/p/491193574 Category: Hardware Wifi Router Version:...

Jiofi 4 (JMR 1140 Amtel_JMR1140_R12.07) - CSRF (Password Disclosure) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Jiofi 4 JMR 1140 CSRF To View Wi-fi Password Exploit Author: Ronnie T Baby Contact:https://www.linkedin.com/in/ronnietbaby Vendor Homepage: www.jio.com Hardware Link: https://www.jio.com/shop/en-in/jmr-1140/p/491193574...

SureBackup performance impacted after installing Veeam Backup & Replication 9.5 Update 4

Challenge You may notice SureBackup job performance degaradation and higher space utilization after upgrading to Veeam Backup & Replication 9.5 U4 9.5.4.2615. Cause Upgrade to Veeam Backup & Replication 9.5 U4 has changed the default location for redo logs for verified VMs impacting original...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4531)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4531 advisory. - x86/bugs: Fix the AMD SSBD usage of the SPECCTRL MSR Tom Lendacky Orabug: 28870524 CVE-2018-3639 - x86/bugs: Add AMD's SPECCTRL MSR usage Konrad...

Hyper-V Backup jobs failing with an error "The system cannot find the file specified" after upgrade to Veeam B&R 9.5 Update 4

Challenge After installing Veeam Backup & Replication 9.5 Update 4, Hyper-V backup without application-aware processing may fail with the error "The system cannot find the file specified". Version Specific Article This article is relevant only to Veeam Backup & Replication 9.5.4.2615. Cause This...

kcodecs/kcodecs_fuzzer: Global-buffer-overflow in kencodingprober::nsCodingStateMachine::NextState

Project: git://anongit.kde.org/kcodecs Detailed report: https://oss-fuzz.com/testcase?key=5191762182668288 Project: kcodecs Fuzzer: libFuzzerkcodecsfuzzer Fuzz target binary: kcodecsfuzzer Job Type: libfuzzerasankcodecs Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Address:...

[SECURITY] [DLA 1660-1] rssh security update

Package : rssh Version : 2.3.4-4+deb8u2 CVE ID : CVE-2019-3463 CVE-2019-3464 More vulnerabilities were found by Nick Cleaton in the rssh code that could lead to arbitrary code execution under certain circumstances. CVE-2019-3463 reject rsync --daemon and --config command-line options; arbitrary...

Ubuntu: Security Advisory (USN-3871-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

A week in security (January 28 – February 3)

Last week, we ran another in our interview with a malware hunter series, explained a FaceTime vulnerability, and took a deep dive into a new stealer. We also threw some light on a Houzz data breach, and what exactly happened between Apple and Facebook. Other cybersecurity news Kwik Fit hit by...