FreeBSD : Prosody -- Remote Information Disclosure (5ef14250-f47c-11eb-8f13-5b4de959822e)

A Prosody XMPP server advisory reports : It was discovered that Prosody allows any entity to access the list of admins, members, owners and banned entities of any federated XMPP group chat of which they know the address. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Moodle 3.9 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Moodle 3.9 - Remote Code Execution RCE Authenticated Exploit Author: lanz Vendor Homepage: https://moodle.org/ Version: Moodle 3.9 Tested on: FreeBSD !/usr/bin/python3 Moodle 3.9 - RCE Authenticated as teacher Based on PoC and Payload to assign full permissions to manager rol:...

Moodle 3.9 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: Moodle 3.9 - Remote Code Execution RCE Authenticated Date: 12-05-2021 Exploit Author: lanz Vendor Homepage: https://moodle.org/ Version: Moodle 3.9 Tested on: FreeBSD !/usr/bin/python3 Moodle 3.9 - RCE Authenticated as teacher Based on PoC and Payload to assign full permissions to...

FreeBSD : tomcat -- HTTP request smuggling in multiple versions (d34bef0b-f312-11eb-b12b-fc4dd43e2b6a)

Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu of NEU seclab reports : Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: Tomcat incorrectly ignore...

FreeBSD : chromium -- multiple vulnerabilities (c3c6c4a3-f47d-11eb-b632-3065ec8fd3ec)

Chrome Releases reports : This release contains 10 security fixes, including : - 1227777 High CVE-2021-30590: Heap buffer overflow in Bookmarks. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2021-07-09 - 1229298 High CVE-2021-30591: Use after free in File System API. Reported by...

FreeBSD : tomcat -- JNDI Realm Authentication Weakness in multiple versions (8b571fb2-f311-11eb-b12b-fc4dd43e2b6a)

ilja.farber reports : Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data eg user names as well as configuration data provided by an administrator. In limited circumstances it was possible for users to authenticate...

FreeBSD : RabbitMQ -- Denial of Service in AMQP1.0 plugin (b1aa54ae-74cb-42a0-b462-cbb6831c5c50)

Pivotal.io reports : All versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

FreeBSD : tomcat -- Remote Denial of Service in multiple versions (cc7c85d9-f30a-11eb-b12b-fc4dd43e2b6a)

rbeaudry reports : A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. Th...

The vulnerability of the FreeBSD operating systems, related to pointer arithmetic errors, allows attackers to cause an application to terminate abnormally.

The vulnerability of the FreeBSD operating systems is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause an application to terminate abnormally...

FreeBSD : fetchmail -- 6.4.19 and older denial of service or information disclosure (cbfd1874-efea-11eb-8fe9-036bd763ff35)

Matthias Andree reports : When a log message exceeds c. 2 kByte in size, for instance, with very long header contents, and depending on verbosity option, fetchmail can crash or misreport each first log message that requires a buffer reallocation. %NASLMINLEVEL 70300 C Tenable Network Security, In...

FreeBSD : redis -- Integer overflow issues with BITFIELD command on 32-bit systems (c561ce49-eabc-11eb-9c3f-0800270512f4)

Huang Zhw reports : On 32-bit versions, Redis BITFIELD command is vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves constructing specially crafted bit commands which...

FreeBSD : powerdns -- remotely triggered crash (ce79167f-ee1c-11eb-9785-b42e99a1b9c3)

powerdns reports : PowerDNS Security Advisory 2021-01: Specific query crashes Authoritative Server %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and...

FreeBSD : pjsip -- Race condition in SSL socket server (92ad12b8-ec09-11eb-aef1-0897988a1c07)

pjsip reports : There are a couple of issues found in the SSL socket : - A race condition between callback and destroy, due to the accepted socket having no group lock. - SSL socket parent/listener may get destroyed during handshake. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

FreeBSD : asterisk -- pjproject/pjsip: crash when SSL socket destroyed during handshake (53fbffe6-ebf7-11eb-aef1-0897988a1c07)

The Asterisk project reports : Depending on the timing, it's possible for Asterisk to crash when using a TLS connection if the underlying socket parent/listener gets destroyed during the handshake. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

FreeBSD : asterisk -- Remote crash when using IAX2 channel driver (fb3455be-ebf6-11eb-aef1-0897988a1c07)

The Asterisk project reports : If the IAX2 channel driver receives a packet that contains an unsupported media format it can cause a crash to occur in Asterisk. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

FreeBSD : mosquitto -- NULL pointer dereference (cc553d79-e1f0-4b94-89f2-bacad42ee826)

Roger Light reports : If an authenticated client connected with MQTT v5 sent a malformed CONNACK message to the broker a NULL pointer dereference occurred, most likely resulting in a segfault. Note: a CVE is referenced in the github commit but it appears to be for a python-bleach vulnerability so...

FreeBSD : asterisk -- Remote Crash Vulnerability in PJSIP channel driver (ffa364e1-ebf5-11eb-aef1-0897988a1c07)

The Asterisk project reports : When Asterisk receives a re-INVITE without SDP after having sent a BYE request a crash will occur. This occurs due to the Asterisk channel no longer being present while code assumes it is. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

FreeBSD : chromium -- multiple vulnerabilities (76487640-ea29-11eb-a686-3065ec8fd3ec)

Chrome Releases reports : This release contains 35 security fixes, including : - 1210985 High CVE-2021-30565: Out of bounds write in Tab Groups. Reported by David Erceg on 2021-05-19 - 1202661 High CVE-2021-30566: Stack buffer overflow in Printing. Reported by Leecraso and Guang Gong of 360 Alpha...

FreeBSD : cURL -- Multiple vulnerabilities (aa646c01-ea0d-11eb-9b84-d4c9ef517024)

The cURL project reports : CURLOPTSSLCERT mixup with Secure Transport CVE-2021-22926 TELNET stack contents disclosure again CVE-2021-22925 Bad connection reuse due to flawed path name checks CVE-2021-92254 Metalink download sends credentials CVE-2021-92253 Wrong content via metalink not discarded...

FreeBSD : MySQL -- Multiple vulnerabilities (38a4a043-e937-11eb-9b84-d4c9ef517024)

Oracle reports : This Critical Patch Update contains 41 new security patches for Oracle MySQL. 10 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The highest CVSS v3.1 Base Score of...