PHP LibGD Heap Buffer Overflow

!/usr/bin/env python2 PoC for CVE-2016-3074 targeting Ubuntu 15.10 x86-64 with php5-gd and php5-fpm running behind nginx. ,---- | $ python exploit.py --bind-port 5555 http://1.2.3.4/upload.php | this may take a while | offset 912 of 10000... | + connected to 1.2.3.4:5555 | id | uid=33www-data...

[ASA-201701-24] nginx-mainline: privilege escalation

Arch Linux Security Advisory ASA-201701-24 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-1247 Package : nginx-mainline Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-139 Summary ======= The package nginx-mainline...

[ASA-201701-23] nginx: privilege escalation

Arch Linux Security Advisory ASA-201701-23 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-1247 Package : nginx Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-138 Summary ======= The package nginx before version...

Yelp: Nginx version disclosure via forbidden page

This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx. Impact: An attacker might use the disclosed information to harvest specific security vulnerabilities for the version...

GLSA-201701-22 : NGINX: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201701-22 NGINX: Privilege escalation It was discovered that Gentoos default NGINX installation applied similar problematic permissions on /var/log/nginx as Debian DSA-3701 and is therefore vulnerable to the same attack described ...

NGINX: Privilege escalation

Background nginx is a robust, small, and high performance HTTP and reverse proxy server. Description It was discovered that Gentoo’s default NGINX installation applied similar problematic permissions on “/var/log/nginx” as Debian DSA-3701 and is therefore vulnerable to the same attack described i...

Skyport Systems: Nginx version disclosure via forbidden page

This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx. Impact: An attacker might use the disclosed information to harvest specific security vulnerabilities for the version...

Robinhood: httponly flag not set + csrftoken in url

INFORMATION hello, i was looking into and found something interesting , i found that the httponly flag is not set which is really harmful as because httponly flag act as filter to stop client side script attacks like xss or session hijacking. so the csrftoken has no httponly flag at...

Wordpress Plugin Olimometer 2.56 - SQL Injection

Vulnerability parameters: olimometerid= Using sqlmap Parameter: olimometerid GET Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: olimometerid=1 AND 6227=6227 Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind Payload: olimometerid=1...

Nginx elevation of privilege vulnerability(CVE-2016-1247) analysis-vulnerability warning-the black bar safety net

0x00 vulnerability overview 1. Vulnerability description 11 on 15 September, foreign security researcher Dawid Golunski discloses a new Nginx Vulnerability, CVE-2016-1247, and can affect based on Debian-based distributions, Nginx as the current mainstream a multi-purpose server, and thus its harm...

Code injection

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access...

CVE-2016-1247

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access...

CVE-2016-1247

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access...

DEBIAN-CVE-2016-1247

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access...

CVE-2016-1247

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access...

CVE-2016-1247

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access...

CVE-2016-1247

CVE-2016-1247 affects nginx products (Debian, Ubuntu, Gentoo) where older nginx binaries (e.g., Debian jessie <1.6.2-5+deb8u3; Ubuntu 14.04/16.04/16.10 < listed versions; Gentoo ebuild = 1.10.2 on Gentoo, 1.10.2-3 on Arch, newer upstream branches). An in-wild PoC exploit exists (logrotate-b...

Peplink NGxxx/LCxxx VPN-Firewall Open Redirect

Peplink NGxxx/LCxxx VPN-Firewall Open Redirect Vulnerability Vendor: Qingdao Xunbo Information Technology Co., Ltd. Product web page: http://www.peplink.net Affected version: PEPLINK NG300 VPN-Firewall PEPLINK NG320-VPN-Firewall PEPLINK NG500-VPN-Firewall PEPLINK NG520-VPN-Firewall PEPLINK...

Linux application permissions incorrectly can provide the right series vulnerability analysis-vulnerability warning-the black bar safety net

Foreword linux to powerful file management system, in actual use, although able to work provide great convenience, but if the permissions improper handling, may cause a certain security risk, such as in the operation of the file, change some folder permissions, when the use of some can be freely...

EasyPHP Devserver 16.1.1 - Cross-Site Request Forgery / Remote Command Execution

Exploit for php platform in category web applications + Credits: John Page aka hyp3rlinx Vendor: =============== www.easyphp.org Product: ============================= EasyPHP Devserver v16.1.1 easyphp-devserver-16.1.1-setup.exe hash: 64184d330a34be9e6c029ffa63c903de A complete WAMP environment f...