CVE-2019-0129

CVE-2019-0129 : Improper permissions in Intel® USB 3.0 Creator Utility may allow an authenticated user to escalate privileges via local access. Affected products: Intel USB 3.0 Creator Utility (all versions). Root cause: permission misconfiguration leading to local privilege escalation. Impact: l...

CVE-2019-0129

Improper permissions for IntelR USB 3.0 Creator Utility all versions may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2019-0129: Undefined Security Weakness

Improper permissions for IntelR USB 3.0 Creator Utility all versions may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2019-18180

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 14.0.0 through 14.0.0.2 F5 BIG-IP versions 13.0.0 through 13.1.0.7 F5 BIG-IP versions 12.1.0 through 12.1.3.5 F5 BIG-IP versions 11.6.1 through 11.6.3.2 F5 BIG-IP versions 11.5.1 through 11.5.8 F5 Enterprise Manager version...

PT-2019-18181

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.6.1 through 11.6.3.2 F5 BIG-IP versions 11.5.1 through 11.5.8 F5 Enterprise Manager version 3.1.1 Description The issue is related to improper escaping of values in an undisclosed page of the configuration utility. This c...

CVE-2019-6599: Improper Neutralization of Input During Web Page Generation

In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting XSS attack...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K23734425)

When remote authentication is enabled for administrative users and all external users are granted the guest role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients. CVE-2019-6600 Impact BIG-IP This...

PT-2019-1750

Name of the Vulnerable Software and Affected Versions Intel USB 3.0 Creator Utility versions all Description The issue is related to insufficient access control in the Intel USB 3.0 Creator Utility, which may allow an authenticated user to potentially enable escalation of privilege via local...

elFinder PHP Connector < 2.1.48 - exiftran Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in elFinder versions prior to 2.1.48. The PHP connector component allows unauthenticated users to upload files and perform file modification operations, such as resizing and rotation of an image. The file name of uploaded files is...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K44603900)

Malformed requests to the Traffic Management User Interface TMUI, also referred to as the BIG-IP Configuration utility,may lead to disruption of TMUI services. This attack requires an authenticated user with any role other than the No Access role. The No Access user role cannot login and does not...

F5 Networks BIG-IP : BIG-IP Configuration utility vulnerability (K46401178)

Improper escaping of values in an undisclosed page of the BIG-IP Configuration utilitymay result in an improper handling on the JSON response when it is injected by a malicious script through a remotecross-site scripting XSS attack. CVE-2019-6599 Impact BIG-IP andEnterprise Manager This...

50m-ctf: `Cody trolled us all` h1-702 CTF write-up

Premise I use not to play CTF challenges because they usually absorb me entirely. I cannot think of anything else but "I want that flag!". That said, this is going to be a long story: no princess, no dragoons, only a tweet. https://twitter.com/Hacker0x01/status/1100543680383832065 Level 0 - Nothi...

[SECURITY] Fedora 28 Update: ignition-0.31.0-1.gitf59a653.fc28

Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files regular files, systemd units, networkd units, etc., and configuring users. On first boot, Ignition reads its configuration from a source of truth remote UR...

Imperva SecureSphere 13.x PWS Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Imperva SecureSphere PWS Command Injection', 'Description' = %q This module exploits a command injection vulnerability in Imperva SecureSphere...

Imperva SecureSphere 13.x PWS Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in Imperva SecureSphere version 13.x. The vulnerability exists in the PWS service, where Python CGIs did not properly sanitize user supplied command parameters and directly passes them to corresponding CLI utility, leading to comma...

USN-3885-2: OpenSSH vulnerability

USN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix for CVE-2019-6111 turned out to be incomplete. This update fixes the problem. Original advisory details: Harry Sintonen discovered multiple issues in the OpenSSH scp utility. If a user or automated system were tricked int...

scp file copy concealment

The vulnerability of the scp file copy utility implementation is related to lack of access control mechanisms. Exploiting this vulnerability allows a malicious actor to conceal the name of the transferred file while operating remotely...

elFinder Command Injection v<2.1.48

elFinder is an open-source file manager available as a web application. A command injection vulnerability in the image handling functionality exists for versions prior to 2.1.48. This exploit requires that the exiftran utility be installed. Recent assessments: space-r7 at May 09, 2019 5:57pm UTC...

Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 7 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-3180 DESCRIPTION: An unspecified...

CVE-2019-6589: Improper Neutralization of Input During Web Page Generation

On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting XSS vulnerability is present in an undisclosed page of the BIG-IP TMUI Traffic Management User Interface also known as the BIG-IP configuration utility...