Webmin 1.910 - Package Updates Remote Command Execution (Metasploit)

Webmin 1.910 - Package Updates Remote Command Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin Package Updates Remote Command Execution', 'Description' = %q This modu...

Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin Package Updates Remote Command Execution', 'Description' = %q This module exploits an arbitrary command execution vulnerability in Webmin...

Webmin 1.910 - (Package Updates) Remote Command Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin %q This module exploits an arbitrary command execution vulnerability in Webmin 1.910 and lower versions. Any user authorized to the "Packa...

Webmin 1.910 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin %q This module exploits an arbitrary command execution vulnerability in Webmin 1.910 and lower versions. Any user authorized to the "Packa...

Webmin Package Updates Remote Command Execution

This module exploits an arbitrary command execution vulnerability in Webmin 1.910 and lower versions. Any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges. Module Options msf use exploit/linux/http/webmin/packageuprce msf undefinedpackageuprce sh...

candlepin: credentials exposure through log files

It was discovered that a world-readable log file, belonging to the Candlepin component of Red Hat Satellite 6.4, leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from...

SUSE-SU-2019:1006-1 Security update for SUSE Manager Server 3.2

This update includes the following new features: to the repository metadata fate325676 This update fixes the following issues: apache-commons-lang3: - Run fdupes on javadoc - Specify java target and source level 1.6 to make package compatible with JDK = 1.8 cobbler: - Fixes case where distributio...

Design/Logic Flaw

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching...

CVE-2019-3891

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching...

CVE-2019-3891

It was discovered that a world-readable log file, belonging to the Candlepin component of Red Hat Satellite 6.4, leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from...

openSUSE Security Update : tryton (openSUSE-2019-1013)

This update for tryton to version 4.2.19 fixes the following issues : Security issue fixed : - CVE-2018-19443: Fixed an information leakage by attemping to initiate an unencrypted connection, which would fail eventually, but might leak session information of the user boo1117105 This update also...

Debian: Security Advisory (DLA-1637-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux: Package updates available

Package updates may include vulnerability fixes or new functionality to a package. Keeping the packages to the newest available version reduces the risk of a successful attack. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are...

Updated live, ffmpeg, mplayer, and vlc packages fix security vulnerabilities

A bug in the server implementation of RTSP-over-HTTP in live could allow a denial-of-service attack. A bug in the server implementation of RTSP-over-HTTP could allow a buffer overflow, which could result in the execution of arbitrary code when parsing a malformed RTSP stream CVE-2018-4013. The...

Debian: Security Advisory (DLA-1551-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the cloud platform NextCloud in the operating system OpenSUSE Leap allows a hacker to gain root privileges.

The vulnerability of the cloud platform NextCloud in the operating system OpenSUSE Leap is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain root privileges during package updates using scripts located in the...

Important Photon OS Security Update - PHSA-2018-0117

Updates of 'go' packages of Photon OS have been released...

Debian: Security Advisory (DLA-1122-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated rsync package fixes security vulnerabilities

The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemonfilterlist data structure, which allows remote attackers to bypass intended access restrictions...

UPDATE: Kali Linux 2017.2 Release

PenTestIT RSS Feed About five months ago, I wrote about Kali Linux 2017.1. We now have an update - Kali Linux 2017.2, which is a roll-up of all updates since the last release. In addition to all of the standard security and package updates that are submitted via Debian Testing, this release also...