Liferay Portal Remote Code Execution

Exploit Title: Data in Liferay Portal prior to 7.2.1 CE GA2 - Remote code execution Author: nu11secur1ty Date: 2020-01-24 Vendor: Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7961 https://github.com/nu11secur1ty/Windows10Exploits/tree/master/Undefined/CVE-2020-7961 CVE:...

Liferay Portal Java Unmarshalling Remote Code Execution Exploit

This Metasploit module exploits a Java unmarshalling vulnerability via JSONWS in Liferay Portal versions prior to 6.2.5 GA6, 7.0.6 GA7, 7.1.3 GA4, and 7.2.1 GA2 to execute code as the Liferay user. Tested against 7.2.0 GA1. This module requires Metasploit: https://metasploit.com/download Current...

Huawei EulerOS: Security Advisory for libcroco (EulerOS-SA-2020-1475)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Liferay Portal Java Unmarshalling Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Liferay Portal Java Unmarshalling via JSONWS RCE', 'Description' = %q This module exploits a Java unmarshalling vulnerability via JSONWS in Lifer...

CVE-2020-7961

creationtimestamp| type| source ---|---|--- 2020-03-30 13:40:04+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/4056 2020-04-15 04:46:00+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/liferayjavaunmarshalling.rb 2020-04-16...

CVE-2020-7961

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS...

CVE-2020-7961

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS...

CVE-2020-7961

The CVE-2020-7961 issue affects Liferay Portal’s JSONWS deserialization of untrusted data, enabling unauthenticated remote code execution. Vulnerable software is Liferay Portal prior to 7.2.1 CE GA2, where the root cause is unsafe deserialization in JSONWebServiceActionParameters processed via JS...

CVE-2020-7961

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS. Recent assessments: wvu-r7 at April 08, 2020 6:31pm UTC reported: A Metasploit module has been written:...

Huawei EulerOS: Security Advisory for libcroco (EulerOS-SA-2020-1251)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Adobe Prelude CC < 8.1.1 Arbitrary Code Execution (APSB19-35)

The version of Adobe Prelude CC installed on the remote Windows host is prior to 8.1.1 It is, therefore, affected by a vulnerability as referenced in the apsb19-35 advisory: - Insecure Library Loading DLL hijacking potentially leading to arbitrary code execution CVE-2019-7961 Note that Nessus has...

Huawei EulerOS: Security Advisory for libcroco (EulerOS-SA-2019-2520)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2019-0389 Updated libcroco packages fix security vulnerability

Updated libcroco packages fix security vulnerabilities: Heap overflow input: check end of input before reading a byte CVE-2017-7960. Undefined behavior tknzr: support only max long rgb values CVE-2017-7961. Denial of service memory allocation error via a crafted CSS file CVE-2017-8834. Denial of...

CVE-2019-7961

Adobe Prelude CC versions 8.1 and earlier have an insecure library loading dll hijacking vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2019-7961

Adobe Prelude CC versions 8.1 and earlier are affected by an insecure library loading (DLL hijacking) vulnerability (CVE-2019-7961). Successful exploitation could lead to arbitrary code execution. The issue is described across multiple sources, and remediation is to apply the Adobe APSB19-35 upda...

openSUSE: Security Advisory for libcroco (openSUSE-SU-2019:1575-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED12 / SLES12 Security Update : libcroco (SUSE-SU-2019:1468-1)

This update for libcroco fixes the following issues : Security issues fixed : CVE-2017-7960: Fixed heap overflow input: check end of input before reading a byte bsc1034481. CVE-2017-7961: Fixed undefined behavior tknzr: support only max long rgb values bsc1034482. CVE-2017-8834: Fixed denial of...

CVE-2018-7961

There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS verification code, successful exploitation can cause sensitive information leak...

CVE-2018-7961

The CVE-2018-7961 entry describes a vulnerability in some Huawei smartphones where a smart SMS verification code is processed incorrectly, enabling an attacker to trick a user into visiting a malicious website or app and potentially leak sensitive information. Affected component: smart SMS verifi...

Security Advisory - Smart SMS Verification Code Vulnerability in Some Huawei Smart Phones

There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Website or malicious App and register. Due to incorrect processing of the smart SMS verification code, successful exploitation can cause sensitive information leak...