openSUSE Security Update : ldb / samba (openSUSE-2020-1313)

"This update for ldb, samba fixes the following issues : Changes in samba : - Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; bso14364 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

RPCbind XDR Parsing Memory Exhaustion Denial of Service (CVE-2017-8779)

A resource exhaustion vulnerability exists in rpcbind, within its associated library libtirpc. The vulnerability is due to an unbounded memory leak when parsing XDR strings. A remote attacker could exploit this vulnerability by sending specially crafted RPC messages to the vulnerable server...

Security update for ldb, samba (important)

openSUSE Security Update: Security update for ldb, samba Announcement ID: openSUSE-SU-2020:1313-1 Rating: important References: 1141320 1162680 1169095 1169521 1169850 1169851 1171437 1172307 1173159 1173160 1173161 1173359 1174120 Cross-References: CVE-2020-10700 CVE-2020-10704 CVE-2020-10730...

Mail.ru: [http://kiwi.youdrive.today/] Information disclosure via Kiwi TCMS vulnerability

Outdated kiwi.youdrive.today Kiwi TCMS instance was vulnerable to information disclosure via JSON-RPC endpoints. Outdated Kiwi TCMS instance was vulnerable to information disclosure via JSON-RPC endpoints. Exploit example dump users info except superuser: curl -i -s -k -X $'POST' -H $'Content-Typ...

CVE-2019-11855

An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9...

Default credentials

An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9...

CVE-2019-11855 ALEOS LAN-Side RPC Server

An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9...

CVE-2019-11855

CVE-2019-11855 affects ALEOS gateway LAN: an RPC server is enabled by default in versions prior to 4.12.0, 4.9.5, and 4.4.9. The issue is exploitable over the network with no authentication (CVSSv3: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying high impact to confidentiality, integrity, and avai...

gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certain domain_release calls leading to a memory leak. Note: This was disputed with the assertion that the issue does not grant any access not already available. It is a problem that on unloading a specific kernel module some memory is leaked but loading kernel modules is a privileged operation. A user could also write a kernel module to consume any amount of memory they like and load that replicating the effect of this bug

...

Apache OFBiz XML-RPC Java Deserialization Exploit

This Metasploit module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.04. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2020-1383

An information disclosure vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system To exploit this vulnerability, an attacker would need to run a...

Information disclosure

An information disclosure vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system To exploit this vulnerability, an attacker would need to run a...

CVE-2020-1383

CVE-2020-1383 is an information disclosure vulnerability in Windows RRAS: when Routing and Remote Access is enabled, an attacker can exploit a flaw in RPC handling to obtain information that could aid compromise. Exploitation requires a crafted application against an RPC server with RRAS enabled ...

Apache OFBiz XML-RPC Java Deserialization

This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for versions prior to 17.12.04. Module Options msf use exploit/linux/http/apacheofbizdeserialiation msf exploitapacheofbizdeserialiation show targets ...targets...

Apache OFBiz XML-RPC Java Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache OFBiz XML-RPC Java Deserialization', 'Description' = %q This module exploits a Java deserialization vulnerability in Apache OFBiz's...

Microsoft Windows Multiple Vulnerabilities (KB4571741)

This host is missing a critical security update according to Microsoft KB4571741 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4566782)

This host is missing a critical security update according to Microsoft KB4566782 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4571694)

This host is missing a critical security update according to Microsoft KB4571694. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4565349)

This host is missing a critical security update according to Microsoft KB4565349 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4571736)

This host is missing a critical security update according to Microsoft KB4571736 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...