Imperva SecureSphere 13.x PWS Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in Imperva SecureSphere version 13.x. The vulnerability exists in the PWS service, where Python CGIs did not properly sanitize user supplied command parameters and directly passes them to corresponding CLI utility, leading to comma...

Imperva SecureSphere 13.x PWS Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Imperva SecureSphere PWS Command Injection', 'Description' = %q This module exploits a command injection vulnerability in Imperva SecureSphere...

USN-3885-2: OpenSSH vulnerability

USN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix for CVE-2019-6111 turned out to be incomplete. This update fixes the problem. Original advisory details: Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a user or automated system were tricked int...

The vulnerability of the scp file copy-to-remote utility’s implementation, related to access control deficiencies, allows a perpetrator to conceal the name of the transferred file.

The vulnerability of the scp file copy utility implementation is related to lack of access control mechanisms. Exploiting this vulnerability allows a malicious actor to conceal the name of the transferred file while operating remotely...

elFinder Command Injection v<2.1.48

elFinder is an open-source file manager available as a web application. A command injection vulnerability in the image handling functionality exists for versions prior to 2.1.48. This exploit requires that the exiftran utility be installed. Recent assessments: space-r7 at May 09, 2019 5:57pm UTC...

Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 7 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified...

The vulnerability of the graphical input utility in the fly-qdm system of the Astra Linux operating system, which allows a intruder to cause a service failure.

The vulnerability of the graphical input utility in the fly-qdm system of the Astra Linux operating system is related to buffer overflows during the copying of lines with commands from the virtual keyboard. Exploiting this vulnerability can allow an attacker to cause a service failure...

ABB Totalflow WellTell Wireless Utility Detection (Windows SMB Login)

Detects the installed version of ABB Totalflow WellTell Wireless Utility for Windows. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

[SECURITY] [DLA 1636-1] aria2 security update

Package : aria2 Version : 1.18.8-1+deb8u1 CVE ID : CVE-2019-3500 Debian Bug : 918058 It was discovered that aria2 the lightweight command-line download utility can store passed user credentials in a log file when using the --log option. This might allow local users to obtain sensitive information...

WEM agents are not syncing consistently with the WEM broker, only if they are rebooted or if the Norskale Agent Host Service is restarted

WEM agents are not syncing consistently with the WEM broker. Running command "AgentCacheUtility -refreshcache" does not return any errors, and refreshing the VUEMUIAgent either. WEM agents sync only when they are rebooted or if the Norskale Agent Host Service is restarted. The Last Connection...

Rockwell Windows Firewall Configuration Utility Detection (Windows SMB Login)

SMB login-based detection of Rockwell Windows Firewall Configuration Utility. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openvswitch: Mishandle of group mods in lib/ofp-util.c:parse_group_prop_ntr_selection_method() allows for assertion failure

An issue was discovered in Open vSwitch OvS, 2.4.x through 2.4.1, 2.5.x through 2.5.5, 2.6.x through 2.6.3, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and2.9.x through 2.9.2, affecting the parsegrouppropntrselectionmethod in lib/ofp-util.c. On controllers with the OpenFlow 1.5 decoder enabled, a...

Arbitrary Code Execution

patch is vulnerable to arbitrary code execution attacks. The vulnerability exists as GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitabl...

[SECURITY] Fedora 29 Update: php-horde-Horde-Image-2.5.4-1.fc29

An Image utility API, with backends for: GD GIF PNG SVG SWF ImageMagick convert command line tool Imagick Extension Optional dependency: php-pecl-imagick...

[SECURITY] Fedora 28 Update: php-horde-Horde-Image-2.5.4-1.fc28

An Image utility API, with backends for: GD GIF PNG SVG SWF ImageMagick convert command line tool Imagick Extension Optional dependency: php-pecl-imagick...

CVE-2019-0088

Insufficient path checking in IntelR System Support Utility for Windows before 2.5.0.15 may allow an authenticated user to potentially enable an escalation of privilege via local access...

CVE-2019-0088

Insufficient path checking in IntelR System Support Utility for Windows before 2.5.0.15 may allow an authenticated user to potentially enable an escalation of privilege via local access...

CVE-2019-0088

Intel System Support Utility for Windows prior to 2.5.0.15 is affected by CVE-2019-0088 due to insufficient path checking, enabling an authenticated user to potentially escalate privileges via local access. The vulnerability is documented across CVE records and Intel’s advisory, which confirms af...

Intel Patches High-Severity Privilege-Escalation Bugs

Intel on Tuesday patched three high-severity vulnerabilities that could allow the escalation of privileges across an array of products. Overall, the chip giant fixed five bugs – three rated high-severity, and two medium-severity. The most concerning of these bugs is an escalation-of-privilege...

Intel® System Support Utility for Windows* Advisory

Summary: A potential security vulnerability in Intel® System Support Utility for Windows may allow an escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2019-0088 Description: Insufficient path checking in Intel...