WebExec Authenticated User Code Execution

This module uses a valid username and password of any level or password hash to execute an arbitrary payload. This module is similar to the "psexec" module, except allows any non-guest account by default. Module Options msf use exploit/windows/smb/webexec msf undefinedwebexec show actions...

CVE-2018-15593

An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can decrypt the encrypted datastore or relay server password by leveraging an unspecified attack vector...

Bro Denial of Service Vulnerability

Bro is an open source framework for network analysis and security monitoring . A denial of service vulnerability exists in the IRC protocol name command parsing process in the analyzer/protocol/irc/IRC.cc file in Bro 2.5.5 and earlier versions, which can be exploited by an attacker to cause a...

Tor: Expose user IP if TOR crashs

Greetings, I have noticed that for unpredictable reason a TOR relay can exposes the IP of an user. I noticed this by going to the server http://195.176.3.24/ and getting information about the headers. I arrived to this header who is : "X-Your-Address-Is" . How : -- - So I went to this tor-relay...

UBUNTU-CVE-2018-17019

In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc...

ExchangeRelayX - An NTLM Relay Tool To The EWS Endpoint For On-Premise Exchange Servers (Provides An OWA For Hackers)

Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking interface, with...

CVE-2018-3911

An exploitable HTTP header injection vulnerability exists in the remote servers of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The hubCore process listens on port 39500 and relays any unauthenticated message to SmartThings' remote servers, which insecurely handle JSON messages...

Canadian Telcos Patch an APT-Ready Flaw in Disability Services

Canadian telcos have patched a widespread local file-disclosure flaw in disability services that allow people who are deaf, hard of hearing, or have a speech disorder to place calls through a text telephone or other assistive devices. The vulnerability opens the door for widespread attacks on...

OWA for hackers: ExchangeRelayX

ExchangeRelayX is a PoC tools to demonstrate the ability of an attacker to perform an SMB or HTTP based NTLM relay attack to the EWS endpoint on an on-premise Microsoft Exchange server to compromise the mailbox of the victim. This tool provides the attacker with an OWA looking interface, with...

IBM Rational ClearQuest Man-in-the-Middle Attack Vulnerability

IBM Rational ClearQuest is a suite of Application Lifecycle Management ALM software from IBM, USA. The software provides defect tracking, process customization, and real-time reporting for applications to improve visibility and control of the development cycle. A man-in-the-middle attack...

CVE-2018-13417

In Vuze Bittorrent Client 5.7.6.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

CVE-2016-2922

IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 CQ OSLC linkages, EmailRelay fails to check the SSL certificate against the requested hostname. It is subject to a man-in-the-middle attack with an impersonating server observing all the data transmitted to the real server. IBM...

[SECURITY] Fedora 28 Update: rsyslog-8.37.0-1.fc28

Rsyslog is an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is compatible with stock sysklogd and can be used as a drop-in replacement. Rsyslog is simple to set up,...

Plex Media Server's SSDP XML External Entity Injection Vulnerability

Plex Media Server is a multimedia entertainment player that supports multiple platforms. Plex Media Server's SSDP is vulnerable to an XML External Entity Injection vulnerability, which can be exploited by an unauthenticated attacker on the same LAN to access arbitrary files from the filesystem wi...

Ramnit Changes Shape with Widespread Black Botnet

The recently uncovered “Black” botnet campaign using the Ramnit malware racked up 100,000 infections in the two months through July– but the offensive could just be a precursor to a much larger attack coming down the pike, according to researchers, thanks to a second-stage malware called Ngioweb...

Vuze Bittorrent Client 5.7.6.0 SSDP Processing XML Injection

Issue: Out-of-Band XXE in Vuze Bittorrent Client's SSDP Processing Reserved CVE: CVE-2018-13417 Vulnerability Overview The XML parsing engine for Vuze Bittorrent Client's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same L...

CVE-2018-13416: Improper Restriction of XML External Entity Reference

In Universal Media Server UMS 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing XXE attack. Remote, unauthenticated attackers can use this vulnerability to: 1 Access arbitrary files from the filesystem with the same permission as the user...

Advanced Man in the Middle Attack Framework: Evilginx

Evilginx is an attack framework for setting up phishing pages. Instead of serving templates of sign-in pages lookalikes, Evilginx becomes a relay between the real website and the phished user . Phished user interacts with the real website, while Evilginx captures all the data being transmitted...

Soleo: Directory Traversal + HTTP Paramater Pollution leaking SQL/LDAP credentials

Upon visiting the login page of a provider’s IP Relay client, we noticed that if someone were to click the “forgot password” link, it would bring them to a URL which appeared as the following: https://./IPRelayApp/servlet/IPRelay?page=forgotPassword When attempting to modify the "page" GET...

CCN-lite buffer overflow vulnerability (CNVD-2018-12269)

CCN-lite is a lightweight CCNx Content Centric Networking Protocol implementation of the CCN-lite project. A heap buffer overflow vulnerability exists in CCN-lite version 2.0.1 in mkAddToRelayCacheRequest and ccnlpopulatecache, which stems from the lack of the terminator '\0' in an array. An...