18 matches found
CatDV Server Authenticated aaftoolPath Root RCE — Detect
Fingerprint / reachability check for CatDV Server Authenticated aaftoolPath Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CatDV Server Authenticated aaftoolPath Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...
CatDV aaftoolPath authenticated root RCE
Login to CatDV web API, PUT server-config aaftoolPath, trigger AAF export. Place the script on the host via sshkey or pre-stage at aaftoolpath. """CatDV authenticated aaftoolPath override → AAF export root RCE.""" from future import annotations import base64 import json import os import re import...
CatDV empty admin password aaftoolPath RCE
Login as admin with factory empty password, override aaftoolPath, trigger AAF export optional sshkey to stage /tmp/evil.sh. """CatDV factory-default empty admin password → aaftoolPath root RCE.""" from future import annotations import base64 import json import os import re import subprocess from...
CatDV unauth RMI aaftoolPath root RCE
SSH to target: unauth RMI saveSettings aaftoolPath + web login trigger AAF export. Requires sshkey root on appliance. """CatDV Server Unauthenticated RMI Root RCE""" from future import annotations from kittysploit import import base64 import os import subprocess import sys import time import re...
EUVD-2021-13495
Malware in sbrugna...
CVE-2021-26705
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within...
CVE-2021-26705
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within...
CVE-2021-26705
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within...
Authentication flaw
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within...
CVE-2021-26705
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within...
CVE-2021-26705
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within...
CVE-2021-26705
CVE-2021-26705 affects SquareBox CatDV Server up to 9.2. An attacker can invoke sensitive RMI methods (e.g., getConnections) without authentication, allowing generation of valid authentication tokens. These tokens can be used to perform administrative tasks within the application, including discl...
SquareBox CatDV Server Access Control Vulnerability
Square Box Systems SquareBox CatDV Server is a software application from Square Box Systems. It provides an agile media management and workflow orchestration platform. A security vulnerability exists in SquareBox CatDV Server through 9.2, which can be exploited by an attacker to generate valid...
CatDV 9.2 - RMI Authentication Bypass Exploit
Exploit Title: CatDV 9.2 - RMI Authentication Bypass Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: https://catdv.com/ Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe Version: 9.2 and lower Tested on: Windows, Mac import org.h2.engine.User;...
CVE-2021-26705: Missing Authentication for Critical Function
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within...
PT-2021-17102
Name of the Vulnerable Software and Affected Versions SquareBox CatDV Server versions through 9.2 Description An issue was discovered in SquareBox CatDV Server, where an attacker can invoke sensitive RMI methods, such as getConnections, without authentication. The results of these methods can be...
CatDV 9.2 Authentication Bypass
Exploit Title: CatDV 9.2 - RMI Authentication Bypass Date: 3/1/2021 Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: https://catdv.com/ Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe Version: 9.2 and lower Tested on: Windows, Mac import...
CatDV 9.2 - RMI Authentication Bypass
Exploit Title: CatDV 9.2 - RMI Authentication Bypass Date: 3/1/2021 Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: https://catdv.com/ Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe Version: 9.2 and lower Tested on: Windows, Mac import...