Cuckoo Sandbox Guest 2.0.1 Code Execution

-- coding: utf8 -- """ Exploit Title: Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC Date: June 28th 2016 Exploit Author: Rémi ROCHER Vendor Homepage: https://cuckoosandbox.org/ Software Link: https://github.com/cuckoosandbox/cuckoo/archive/master.zip Version: = 2.0.1 Tested on: MS Windows 7, MS...

Researcher Pockets $30,000 in Chrome Bounties

Security researcher Mariusz Mlynski is having a good month. Having cashed in earlier in May to the tune of $15,500, Mlynski pocketed another $30,000 courtesy of Google’s bug bounty program after four high-severity vulnerabilities were patched in the Chrome browser, each worth $7,500 to the...

Core Windows Utility Can Be Used to Bypass AppLocker

A core Windows command-line utility, Regsvr32, used to register DLLs to the Windows Registry can be abused to run remote code from the Internet, bypassing whitelisting protections such as Microsoft’s AppLocker. A researcher who requested anonymity found and privately disclosed the issue to...

Juniper Networks ScreenOS Security Bypass Vulnerability

The Juniper Networks QFX5100 and QFX10002 are switch products from Juniper Networks, Inc. A security vulnerability exists in the Juniper Networks ScreenOS that allows remote attackers to exploit the vulnerability to gain administrator privileges on the system and conduct denial of service attacks...

Microsoft Windows Secondary Logon CVE-2016-0135 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to execute arbitrary code with admin privileges in the context of the affected system. Technologies Affected Microsoft Windows 10 for 32-bit Systems Microsoft Windows 10 fo...

MOBOTIX Video Security Cameras Cross Site Request Forgery

Add admin user Testingus: ------------------------- fo...

Generalized Java Deserialization Remote Command Execution Vulnerability in Real Estate Management System of Changchun Changxin Huatian Technology Co.

Real Estate Management System is a product developed for real estate management department for real estate land planning and management, development and construction management, transaction, etc. A generic Java deserialization remote command execution vulnerability exists in the real estate...

Cisco ACE 4710 Device Manager GUI Remote Command Injection Vulnerability (cisco-sa-20160224-ace)

The Cisco Application Control Engine ACE software installed on the remote Cisco ACE 4710 device is an A5 version prior to A53.0. It is, therefore, affected by a remote command injection vulnerability in the device manager GUI due to improper validation of user-supplied input in HTTP POST requests...

Design/Logic Flaw

The Device Manager GUI in Cisco Application Control Engine ACE 4710 A5 before A53.1 allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801...

CVE-2016-1297

The Device Manager GUI in Cisco Application Control Engine ACE 4710 A5 before A53.1 allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801...

CVE-2016-1297: Improper Neutralization of Special Elements used in an OS Command

The Device Manager GUI in Cisco Application Control Engine ACE 4710 A5 before A53.1 allows remote authenticated users to bypass intended RBAC restrictions and execute arbitrary CLI commands with admin privileges via an unspecified parameter in a POST request, aka Bug ID CSCul84801...

PT-2016-4690

Name of the Vulnerable Software and Affected Versions Cisco Application Control Engine ACE 4710 A5 versions prior to A53.1 Description The issue allows remote authenticated users to bypass intended Role-Based Access Control RBAC restrictions. This is achieved by executing arbitrary Command-Line...

MailPoet Newsletters 2.6.19 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: XSS Vulnerability in MailPoet Newsletters Affected Software : MailPoet Newsletters Affected Versions: v2.6.19 and possibly below Vendor Homepage : http://www.mailpoet.com/ Vulnerability Type : Cross-site Scripting Severity : Important...

The vulnerabilities of the P-660HW, NBG-418N, PMG5318 router microprogramming software and the ZyNOS operating system allow a hacker to gain administrator privileges.

The vulnerability of the P-660HW, NBG-418N, PMG5318 router microprogramming software and the ZyNOS operating system is related to the default use of a standard password for the administrator account. Exploiting this vulnerability can allow an attacker, operating remotely, to gain administrator...

ReadyNet WRT300N-DD devices with firmware license issue vulnerability

ReadyNet WRT300N-DD devices with firmware is a wireless router product from ReadyNet New Zealand. An authorization issue vulnerability exists in ReadyNet WRT300N-DD devices with firmware 1.0.26. This allows remote attackers to gain administrative privileges by exploiting a LAN session...

OpenCart 2.1.0.1 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: XSS Vulnerability in OpenCart Affected Software : OpenCart Affected Versions: v2.1.0.1 and possibly below Vendor Homepage : http://www.opencart.com Vulnerability Type : Cross-site Scripting Severity : Important Status : Fixed CVE-ID :...

Serendipity 2.0.2 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: XSS Vulnerability in Serendipity Affected Software : Serendipity Affected Versions: v2.0.2 and possibly below Vendor Homepage : http://www.s9y.org Vulnerability Type : Cross-site Scripting Severity : Important Status : Fixed CVE-ID :...

CVE-2015-5994

The web management interface on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 has a default password of admin for the admin account and a default password of password for the medialink account, which allows remote attackers to obtain administrative privileges by leveraging a...

CVE-2015-7280

The web administration interface on ReadyNet WRT300N-DD devices with firmware 1.0.26 has a default password of admin for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session...

The vulnerability of the microprogramming software of the Telemetry Gateway allows a intruder to gain administrator privileges.

The vulnerability of the Microprogrammed Software of the Telemetry Gateway exists due to the rigid encoding of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain administrator privileges...