Jenkins groovy.util.Expando Java deserialization vulnerability

Added: 08/15/2017 CVE: CVE-2016-0792 BID: 83720 Background Jenkins is a standalone, open-source automation server written in Java. Problem A deserialization vulnerability in the groovy.util.Expando class allows a remote attacker to execute arbitrary commands by requesting createItem with speciall...

Advantech SUSIAccess 3.0 File Upload

! /usr/bin/env ruby =begin Exploit Title: Advantech SUSIAccess RecoveryMgmt File Upload Date: 07/31/17 Exploit Author: james fitts Vendor Homepage: http://www.advantech.com/ Version: Advantech SUSIAccess = 3.0 Tested on: Windows 7 SP1 Relavant Advisories: ZDI-16-630 ZDI-16-628 CVE-2016-9349...

Advantech SUSIAccess 3.0 - Directory Traversal Information Disclosure (Metasploit)

Advantech SUSIAccess 3.0 - Directory Traversal Information Disclosure Metasploit require 'msf/core' class MetasploitModule 'Advantech SUSIAccess Server Directory Traversal Information Disclosure', 'Description' = %q This module exploits an information disclosure vulnerability found in Advantech...

Internet Explorer mshtml.dll Memory Corruption Vulnerability

Added: 08/01/2017 CVE: CVE-2017-0037 BID: 96088 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Microsoft Internet Explorer has two vulnerabilities in the way objects are handled in memory. The first, CVE-2017-0059, is an...

Apache HTTP Server 'mod_http2' Denial-Of-Service Vulnerability - Linux

Apache HTTP Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

SQL injection vulnerability in the bid parameter of Dongyunchuangda CMSabout.php file

Dongyun Tronda Enterprise CMS is an enterprise website building system. SQL injection vulnerability exists in the bid parameter of the CMSabout.php file, which can be exploited by an attacker to obtain sensitive information from the database...

Windows SMB PsImpersonateClient null token vulnerability

Added: 07/13/2017 CVE: CVE-2017-0144 BID: 96704 Background Server Message Block SMB is the protocol used by Microsoft Windows computers to communicate over a network. Problem A remote attacker can execute arbitrary commands with SYSTEM privileges by overwriting the token to a null value and forci...

CVE-2017-2208

Untrusted search path vulnerability in Installer of Electronic tendering and bid opening system available prior to June 12, 2017 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Installer of Electronic tendering and bid opening system available prior to June 12, 2017 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2208

CVE-2017-2208 is an untrusted search path vulnerability in the Installer of the Electronic tendering and bid opening system (available before 12 June 2017). The root cause is an insecure search path that allows a specially crafted executable in an unspecified directory to be executed, enabling ar...

Symantec Management Console XSS/XXE Issues

SUMMARY Symantec has released an update to address two issues that were discovered in the Symantec Management Console. AFFECTED PRODUCTS Symantec Management Console --- CVE | Affected Versions | Remediation CVE-2017-6322 CVE-2017-6323 | Prior to ITMS 8.1 RU1, ITMS 8.0POSTHF6 & ITMS 7.6POSTHF7 |...

Microsoft Windows Multiple Vulnerabilities (KB4022013)

This host is missing an important security update according to Microsoft KB4022013 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

JVN#27198823: Installer of electronic tendering and bid opening system provided by Acquisition, Technology & Logistics Agency may insecurely invoke an executable file

Installer of electronic tendering and bid opening system provided by Acquisition, Technology & Logistics Agency contains an issue with the search path for executable files, which may lead to insecurely invoking an executable file. Impact This vulnerability can be exploited when the following...

kwese.espn.com XSS vulnerability

Vulnerable URL: http://kwese.espn.com/olympics/story//id/19591243/olympic-bid-2024-how-ioc-latest-move-affects-los-angeles-paris/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Design/Logic Flaw

Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May 25, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2178

CVE-2017-2178 describes an untrusted search path vulnerability in the Installer of the ATLA (Acquisition, Technology & Logistics Agency) electronic tendering and bid opening system. The root cause is insecure DLL loading (DLL search path issue) that could allow arbitrary code execution via a Troj...

ATLA Installer of electronic tendering and bid opening system remote code execution vulnerability

Acquisition, Technology & Logistics Agency ATLA Installer of electronic tendering and bid opening system is an electronic tendering and bid opening system installer from Japan's Acquisition, Technology & Logistics Installer of electronic tendering and bid opening system is an installer of...

Microsoft IIS - WebDav 'ScStoragePathFromUrl' Remote Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule ' Microsoft IIS WebDav ScStoragePathFromUrl Overflow', 'Description' = %q Buffer overflow in the ScStoragePathFromUrl function in the WebDAV servic...

DLink / TRENDnet - NCC Service Command Injection Exploit

Exploit for hardware platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'D-Link/TRENDnet NCC Service Command Injection', 'Description' = %q...

Apache Struts 2 Jakarta Multipart Parser file upload command execution

Added: 03/16/2017 CVE: CVE-2017-5638 BID: 96729 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem The Jakarta...