CVE-2022-28157

CVE-2022-28157 affects Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier. The vulnerability allows an attacker with Item/Configure permission to cause the Jenkins controller to upload arbitrary files to an attacker‑supplied FTP server, via FTP. Multiple connected sources corroborate that ...

[slackware-security] zlib

New zlib packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/zlib-1.2.12-i586-1slack15.0.txz: Upgraded. This update fixes memory corruption when deflating i.e., when compressing...

USN-5342-1: Python vulnerabilities

David Schwörer discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS. CVE-2021-3426 It was discovered that Python incorrectly handled certain FTP requests. An attacker could...

USN-5342-1 python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities

David Schwörer discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 18.04 LTS. CVE-2021-3426 It was discovered that Python incorrectly handled certain FTP requests. An attacker could...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Python vulnerabilities (USN-5342-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5342-1 advisory. David Schwrer discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to expose...

PT-2022-6127 · Apache +3 · Apache Commons Net +3

Name of the Vulnerable Software and Affected Versions: Apache Commons Net versions prior to 3.9.0 Description: The issue is related to the FTP client in Apache Commons Net, which trusts the host from PASV response by default. This allows a malicious server to redirect the Commons Net code to use ...

Metasploit Weekly Wrap-Up

Capture Plugin Capturing credentials is a critical and early phase in the playbook of many offensive security testers. Metasploit has facilitated this for years with protocol-specific modules all under the auxiliary/server/capture. Users can start and configure each of these modules individually,...

Fedora: Security Advisory for libxml2 (FEDORA-2022-050c712ed7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Xlight FTP 3.9.3.2 Buffer Overflow Exploit

Exploit Title: Xlight FTP v3.9.3.2 - Buffer Overflow SEH Egghunter + ROP Exploit Author: Hejap Zairy Software Link: http://www.xlightftpd.com/download/setup.exe Tested Version: v3.9.3.22022-1-5 Tested on: Windows 10 64bit 1.- Run python code : 0day-HejapZairy.py 2.- Open 0dayHejap.txt and copy Al...

Sysax FTP Automation 6.9.0 - Privilege Escalation Vulnerability

Exploit Author: bzyo @bzyo Exploit Title: Sysax FTP Automation 6.9.0 - Privilege Escalation Vulnerable Software: Sysax FTP Automation 6.9.0 Vendor Homepage: https://www.sysax.com/ Version: 6.9.0 Software Link: https://www.sysax.com/download/sysaxautosetup.msi Tested on: Windows 10 x64 Details:...

Sysax FTP Automation 6.9.0 Privilege Escalation

Exploit Author: bzyo @bzyo Exploit Title: Sysax FTP Automation 6.9.0 - Privilege Escalation Date: 03-20-2022 Vulnerable Software: Sysax FTP Automation 6.9.0 Vendor Homepage: https://www.sysax.com/ Version: 6.9.0 Software Link: https://www.sysax.com/download/sysaxautosetup.msi Tested on: Windows 1...

Sysax FTP Automation 6.9.0 - Privilege Escalation

Exploit Author: bzyo @bzyo Exploit Title: Sysax FTP Automation 6.9.0 - Privilege Escalation Date: 03-20-2022 Vulnerable Software: Sysax FTP Automation 6.9.0 Vendor Homepage: https://www.sysax.com/ Version: 6.9.0 Software Link: https://www.sysax.com/download/sysaxautosetup.msi Tested on: Windows 1...

EulerOS 2.0 SP5 : ruby (EulerOS-SA-2022-1337)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to tri...

Xlight FTP 3.9.3.2 Buffer Overflow

Exploit Title: Xlight FTP v3.9.3.2 - Buffer Overflow SEH Egghunter + ROP Exploit Author: Hejap Zairy Date: 13.07.2022 Software Link: http://www.xlightftpd.com/download/setup.exe Tested Version: v3.9.3.22022-1-5 Tested on: Windows 10 64bit 1.- Run python code : 0day-HejapZairy.py 2.- Open...

SUSE: Security Advisory (SUSE-SU-2022:0882-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2022:0882-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0882-1 advisory. - CVE-2021-4189: Fixed default access from PASV response in the FTP client bsc1194146. - CVE-2022-0391: Fixed sanitizing of URLs...

SUSE-SU-2022:0882-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2021-4189: Fixed default access from PASV response in the FTP client bsc1194146. - CVE-2022-0391: Fixed sanitizing of URLs containing ASCII newline and tabs in urlparse bsc1195396...

redhat-support-lib-python and redhat-support-tool bug fix and enhancement update

An update is available for redhat-support-tool, redhat-support-lib-python. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The redhat-support-tool utility...

Vulnerabilities fixed in mariadb

Vulnerabilities have been fixed in mariadb 10.2.43. Due to an error in the handling and validation of database queries, a local attacker is able to crash the application or increase the user privileges to service account privileges. -= SUSE =- SUSE has made updates available to address the...

[slackware-security] Slackware 15.0 kernel

New kernel packages are available for Slackware 15.0 to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/linux-5.15.27/: Upgraded. These updates fix various bugs and security issues, including the recently announced "Dirty Pipe" vulnerability which...