2420 matches found
PT-2015-3574
Name of the Vulnerable Software and Affected Versions Async Http Client versions prior to 1.9.0 Description The issue allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical configuration, as demonstrated by a configuration that doe...
Fedora Update for async-http-client FEDORA-2015-6891
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 20 Update: async-http-client-1.7.22-2.fc20
Async Http Client library purpose is to allow Java applications to easily execute HTTP requests and asynchronously process the HTTP responses. The Async HTTP Client library is simple to use...
[SECURITY] Fedora 22 Update: python-httplib2-0.9-6.fc22
A comprehensive HTTP client library that supports many features left out of other HTTP libraries...
async-http-client: SSL/TLS certificate verification is disabled under certain conditions
It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle MITM attacker could use this flaw to spoof a valid certificate...
async-http-client: missing hostname verification for SSL certificates
It was found that async-http-client did not verify that the server hostname matched the domain name in the subject's Common Name CN or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any...
async-http-client: SSL/TLS certificate verification is disabled under certain conditions
It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also used client certificates. A man-in-the-middle MITM attacker could use this flaw to spoof a valid certificate...
QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)
Exploit Title: QNAP admin shell via Bash Environment Variable Code Injection Date: 7 February 2015 Exploit Author: Patrick Pellegrino | [email protected] work / [email protected] other Employer homepage: http://www.securegroup.it Vendor...
Generic Web Application DLL Injection
This is a general-purpose module for exploiting conditions where a HTTP request triggers a DLL load from an specified SMB share. This module serves payloads as DLLs over an SMB service and allows an arbitrary HTTP URL to be called that would trigger the load of the DLL. Module Options msf use...
Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation Exploit
This module exploits a stacked SQL injection in order to add an administrator user to the SolarWinds Orion database. Usage Info msf use auxiliary/gather/solarwindsorionsqli msf auxiliarysolarwindsorionsqli show actions ...actions... msf auxiliarysolarwindsorionsqli set ACTION msf...
Lexmark MarkVision Enterprise - Arbitrary File Upload (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Lexmark MarkVision Enterprise Arbitrary File Upload', 'Description' = %q This module exploits a code execution flaw in Lexmark...
ActualAnalyzer Cookie Command Execution Vulnerability
This Metasploit module exploits a command execution vulnerability in ActualAnalyzer version 2.81 and prior. The 'aa.php' file allows unauthenticated users to execute arbitrary commands in the 'ant' cookie. This module requires Metasploit: http://metasploit.com/download Current source:...
Device42 WAN Emulator 2.3 - Ping Command Injection (Metasploit)
Device42 WAN Emulator 2.3 - Ping Command Injection Metasploit This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WAN Emulator v2.3 Command Execution', 'Description' = %q , 'License' =...
Device42 Traceroute Command Injection
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WAN Emulator v2.3 Command Execution', 'Description' = %q , 'License' = MSFLICENSE, 'Privileged' = true, 'Platform' = 'unix', 'Arch' =...
Device42 Ping Command Injection
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WAN Emulator v2.3 Command Execution', 'Description' = %q , 'License' = MSFLICENSE, 'Privileged' = true, 'Platform' = 'unix', 'Arch' =...
Citrix NetScaler SOAP Handler Remote Code Execution
No description provided by source. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpClient include...
i-FTP 2.20 - Buffer Overflow SEH Exploit
No description provided by source. !/usr/bin/python Exploit Title:i-FTP Buffer Overflow SEH Homepage:http://www.memecode.com/iftp.php Software Link:www.memecode.com/data/iftp-win32-v220.exe Version:i.Ftp v2.20 Win32 Release Vulnerability discovered:26.10.2014 Description:Simple portable cross...
[SECURITY] Fedora 21 Update: rubygem-httpclient-2.4.0-2.fc21
an interface to HTTP Client for the ruby language...