1177 matches found
CVE-2017-5228
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the...
CVE-2017-5229
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parsedump function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console...
CVE-2017-5231
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmddownload function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit...
CVE-2017-5228: Improper Limitation of a Pathname to a Restricted Directory
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the...
PT-2017-16406
Name of the Vulnerable Software and Affected Versions Rapid7 Metasploit versions prior to 4.13.0-2017020701 Description The issue concerns a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd download function. This vulnerability can be exploited by using a...
PT-2017-16403
Name of the Vulnerable Software and Affected Versions Rapid7 Metasploit versions prior to 4.13.0-2017020701 Description The issue concerns a directory traversal vulnerability in the Meterpreter stdapi Dir.download function. This allows an attacker to write to an arbitrary directory on the...
HEVD kernel vulnerability training-with Windows play-bug warning-the black bar safety net
For this training of the research study will kernel vulnerability principle, the use of the way, under Windows many common data structures have a preliminary understanding, from the open Ring0 gate. HEVD project address: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver For the kernel...
Oracle Outside In Technology PDF parser confusion Code Execution Vulnerability
Summary An exploitable arbitrary write vulnerability exists in the PDF parser functionality of Oracle Outside In Technology SDK. A specially crafted PDF document can cause a parser confusion resulting in an arbitrary write vulnerability ultimately leading to code execution. Tested Versions Oracle...
Google Android - 'IOMXNodeInstance::enableNativeBuffers' Unchecked Index
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=932 The code in IOMXNodeInstance.cpp that handles enableNativeBuffers uses portindex without validation, leading to writing the dword value 0 or 1 at an attacker controlled offset from the IOMXNodeInstance structure. The vulnerable...
DLA-697-1 bsdiff - security update
Bulletin has no description...
openSUSE Security Update : php5 (openSUSE-2016-1095)
This update for php5 fixes the following security issues : - CVE-2016-7124: Create an Unexpected Object and Don't Invoke wakeup in Deserialization - CVE-2016-7125: PHP Session Data Injection Vulnerability - CVE-2016-7126: selectcolors write out-of-bounds - CVE-2016-7127: imagegammacorrect allowed...
SUSE-SU-2016:2328-1 Security update for php53
This update for php53 fixes the following security issues: CVE-2014-3587: Integer overflow in the cdfreadpropertyinfo affecting SLES11 SP3 bsc987530 CVE-2016-6297: Stack-based buffer overflow vulnerability in phpstreamzipopener bsc991426 CVE-2016-6291: Out-of-bounds access in...
Internet Bug Bounty: imagegammacorrect allows arbitrary write access
Upstream Bug --- 2016-08-02 03:46 UTC https://bugs.php.net/bug.php?id=72730 Summary -- imagegammacorrect accepts two gamma values, if they don't have the same sign then the palette colors will be assigned values bigger than 0xFF, later this values are used to calculate the transparent color using...
Internet Bug Bounty: gdImageTrueColorToPaletteBody allows arbitrary write/read access
Upstream bug report ================ 2016-06-29 04:03 UTC https://bugs.php.net/bug.php?id=72512 Patch ===== 2016-07-19 07:47 UTC http://git.php.net/?p=php-src.git;a=commit;h=928aecc002e906b309b28f0062f03d4e5eda3e45 Fixed for PHP 5.5 security only mode, PHP 5.6, PHP 7.0...
Magento < 2.0.6 - Unauthenticated Arbitrary Unserialize -> Arbitrary Write File
Exploit for php platform in category web applications arbitrary write file // Date: 18/05/206 // Exploit Author: agix discovered by NETANEL RUBIN // Vendor Homepage: https://magento.com // Version: /shipping-information // in the response check the payment method it may vary from checkmo // // If...
CVE-2015-0861: Undefined Security Weakness
model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records...
CVE-2015-7430: Undefined Security Weakness
The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System GPFS allows local users to read or write to arbitrary GPFS data via unspecified vectors...
PT-2016-3773
Name of the Vulnerable Software and Affected Versions Hadoop connector versions 1.1.1, 2.4, 2.5, and 2.7.0-0 through 2.7.0-2 Description The issue allows local users to read or write to arbitrary GPFS data via unspecified vectors. Recommendations For version 1.1.1, update to a version after...
PT-2016-3567
Name of the Vulnerable Software and Affected Versions trytond versions 3.2.x through 3.2.9 trytond versions 3.4.x through 3.4.7 trytond versions 3.6.x through 3.6.4 trytond versions 3.8.x through 3.8.0 Description The issue allows remote authenticated users to bypass intended access restrictions...
