DEBIAN-CVE-2015-5211

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being...

CVE-2015-5211

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being...

CVE-2015-5211: Files or Directories Accessible to External Parties

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download RFD attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being...

Share“the eternal blue MS17-010）”batch remote detection tools-vulnerability warning-the black bar safety net

In view of the distinguished manufacturers are relatively self-sustaining, refused to publish easy-to-use batch scanning tool, here on behalf of. You hard to force the network, you find in their own territory and sweep. In particular despise itonly to pay for the user issuing the batch testing...

x86: 64bit PV guest breakout via pagetable use-after-mode-change

ISSUE DESCRIPTION 64-bit PV guests typically use separate root page tables for their kernel and user modes. Hypercalls are accessible to guest kernel context only, which certain hypercall handlers make assumptions on. The IRET hypercall replacing the identically name CPU instruction is used by...

PT-2017-16377

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions prior to 2015.8.13 SaltStack Salt versions 2016.3.x prior to 2016.3.5 SaltStack Salt versions 2016.11.x prior to 2016.11.2 Description The issue arises when using the local batch client from salt-api in SaltStack Salt,...

New Clues Surface on Shamoon 2's Destructive Behavior

Researchers on Monday reported progress in piecing together some of the missing pieces of the Shamoon 2 puzzle that have been eluding them when it comes to lateral network movement and execution of the Disttrack malware component used in past campaigns. Shamoon 2 uses a combination of legitimate...

Dr0p1t-Framework 1.2 - A Framework That Creates An Advanced FUD Dropper With Some Tricks

Have you ever heard about trojan droppers ? In short dropper is type of trojans that downloads other malwares and Dr0p1t gives you the chance to create a dropper that bypass most AVs and have some tricks ; Features Framework works with Windows and Linux Download executable on target system and...

CVE-2016-9051

An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can...

CVE-2016-9051

An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can...

Aerospike Database Server Client Batch Request Code Execution Vulnerability

Summary An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attack...

PT-2017-2444 · Aerospike · Aerospike Database Server

Name of the Vulnerable Software and Affected Versions: Aerospike Database Server version 3.10.0.3 Description: The issue is related to an out-of-bounds write vulnerability in the batch transaction field parsing functionality. This can be triggered by a specially crafted packet, leading to memory...

CVE-2016-9051: Out-of-bounds Write

An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause an out-of-bounds write resulting in memory corruption which can lead to remote code execution. An attacker can...

Kernel security update: Virtuozzo ReadyKernel patch 11.0 for kernels 3.10.0-327.18.2.vz7.15.2 (Virtuozzo 7.0.0) and 3.10.0-327.36.1.vz7.18.7 (Virtuozzo 7.0.1)

The cumulative Virtuozzo ReadyKernel patch updated with security fixes as well as a usability bug fix. The patch applies to Virtuozzo versions 7.0.0 and 7.0.1. Vulnerability id: PSBM-57511 A flaw was found in the way nfnetlink validated length of batch messages that could allow a user logged in t...

dirsearch - Brute Force Directories and Files in Websites

dirsearch is a simple command line tool designed to brute force directories and files in websites. Operating Systems supported Windows XP/7/8/10 GNU/Linux MacOSX Features Multithreaded Keep alive connections Support for multiple extensions -e|--extensions asp,php Reporting plain text, JSON...

Guest Post: Bamm Visscher on Detection

Yesterday my friend Bamm Visscher published a series of Tweets on detection. I thought readers might like to digest it as a lightly edited blog post. Here, then, is the first ever as far as I can remember guest post on TaoSecurity Blog. Enjoy. When you receive new threat intel and apply it in you...

Piwigo File Containment Vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A security vulnerability exists in the admin/batchmanager.php file in Piwigo 2.8.3 and earlier versions. A remote attacke...

PT-2016-4573

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.4 Description The issue allows remote authenticated administrators to conduct File Inclusion attacks. This is achieved via the page'tab' variable, also known as the mode parameter, in the admin/batch manager.php...

CVE-2016-6848: Undefined Security Weakness

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client "Reflected File Download". Malicious platform specific e.g. Microsoft Windows batch file can be created via a trusted domain without...

openSUSE Security Update : the Linux Kernel (openSUSE-2016-1426)

The openSUSE Leap 42.2 kernel was updated to 4.4.36 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2015-1350: The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended...