HelpDeskZ < 1.0.2 - (Authenticated) SQL Injection / Unauthorized File Download

''' Exploit Title: HelpDeskZ fetchRow"SELECT , COUNTid AS total FROM ".TABLEPREFIX."attachments WHERE id=".$db-realescapestring$params2." AND ticketid=".$params0." AND msgid=".$params3; third argument AND msgid=".$params3; sent to fetchRow query with out any senitization Steps to reproduce:...

HelpDeskZ 1.0.2 - (Authenticated) SQL Injection Unauthorized File Download

HelpDeskZ 1.0.2 - Authenticated SQL Injection Unauthorized File Download ''' Exploit Title: HelpDeskZ fetchRow"SELECT , COUNTid AS total FROM ".TABLEPREFIX."attachments WHERE id=".$db-realescapestring$params2." AND ticketid=".$params0." AND msgid=".$params3; third argument AND msgid=".$params3;...

WordPress Plugin WP Support Plus Responsive Ticket System Elevation of Privilege Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . WordPress plugin WP Support Plus Responsive Ticket System has an elevation of privilege vulnerability that can b...

WordPress WP Support Plus Responsive Ticket System 7.1.3 Plugin - Privilege Escalation Vulnerability

Exploit for php platform in category web applications Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 Privilege Escalation Date: 10-01-2017 Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/ Exploit Author: Kacper Szurek Contact:...

WordPress WP Support Plus Responsive Ticket System 7.1.3 Privilege Escalation

Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 Privilege Escalation Date: 10-01-2017 Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/...

WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 - Privilege Escalation

Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 Privilege Escalation Date: 10-01-2017 Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/...

Updated samba packages fix security vulnerability

Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" TGT, which can be used to fully impersonate the...

WordPress Plugin Support Plus Responsive Ticket System SQL Injection Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A SQL injection vulnerability exists in the catid parameter of the admin-ajax.php page in version 7.1.3 of the...

UBUNTU-CVE-2016-2126

Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC Privilege Attribute Certificate checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the...

Secure Ticket Authority (STA) Status Is Marked As DOWN on Citrix Gateway Virtual Server

The CitrixGateway virtual server configured with Secure Ticket Authority STA is marked as DOWN, as shown in the following screen shot:...

When Launching an Application Internally via Netscaler User Receives Error: "Cannot Connect To The Citrix XenApp Server. There Is No Citrix XenApp Server Configured On The Specified Address"

With a NetScaler Gateway and StoreFront setup, while launching application users get following or similar errors: "Unable to launch your application. Contact your help desk with the following information. Cannot connect to the Citrix XenApp server. There is no Citrix XenApp server configured on t...

WordPress W3 Total Cache 0.9.4.1 Race Condition

------------------------------------------------------------------------ Information disclosure race condition in W3 Total Cache WordPress Plugin ------------------------------------------------------------------------ Sipke Mellema, July 2016...

Blockchain: Information disclosure at https://blockchain.atlassian.net

The reporter identified mildly sensitive information leaked through an internal ticket-tracking system, due to a flaw in the ticket-tracking system setting some items to a "Public" shared default setting. We made adjustments to the ticket-tracking system and resolved the issue...

MySQL 5.7.x < 5.7.16 Multiple Vulnerabilities (October 2016 CPU) (SWEET32)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.16. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in s3srvr.c, sslsess.c, and t1lib.c due to improper use of pointer arithmetic for heap-buffer boundary checks. An...

Tor -- remote denial of service

The Tor Blog reports: Prevent a class of security bugs caused by treating the contents of a buffer chunk as if they were a NUL-terminated string. At least one such bug seems to be present in all currently used versions of Tor, and would allow an attacker to remotely crash most Tor instances,...

CompTIA Information Disclosure

I was signed up CompTIA account with a fake name for a privacy reason. Later on, I wanted to update my name in CompTIA account because I was planning to take their Security+ certificate. The problem is I cannot update my name directly from the profile menu, it told me to create a support ticket...

SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2016:2394-1)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag no...

openssl: Insufficient TLS session ticket HMAC length checks

An integer underflow flaw leading to a buffer over-read was found in the way OpenSSL parsed TLS session tickets. A remote attacker could use this flaw to crash a TLS server using OpenSSL if it used SHA-512 as HMAC for session tickets...

openssl security update

1.0.1e-48.3 - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2179 - further DoS issues in DTLS - fix CVE-2016-2180 - OOB read in TSOBJprintbio - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue - fix...

SUSE SLES12 Security Update : openssl (SUSE-SU-2016:2387-1)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag no...