Palo Alto Networks - 'readSessionVarsFromFile()' Session Corruption (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Palo Alto Networks readSessionVarsFromFile Session Corruption', 'Description' = %q This module exploits a chain of vulnerabilities in Palo Alto...

Palo Alto Networks readSessionVarsFromFile() Session Corruption

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Palo Alto Networks readSessionVarsFromFile Session Corruption', 'Description' = %q This module exploits a chain of vulnerabilities in Palo Alto...

Palo Alto Networks readSessionVarsFromFile() Session Corruption

This module exploits a chain of vulnerabilities in Palo Alto Networks products running PAN-OS versions prior to 6.1.19, 7.0.19, 7.1.14, and 8.0.6. This chain starts by using an authentication bypass flaw to to exploit an XML injection issue, which is then abused to create an arbitrary directory,...

xdebug Unauthenticated OS Command Execution Exploit

This Metasploit module exploits a vulnerability in the eval command present in Xdebug versions 2.5.5 and below. This allows the attacker to execute arbitrary php code as the context of the web user. This module requires Metasploit: https://metasploit.com/download Current source:...

The vulnerability of the bta_scan_results_cb_impl function (btif_ble_scanner.cc) in the Android operating system, which allows a hacker to trigger a service failure

The vulnerability of the btascanresultscbimpl function btifblescanner.cc in the Android operating system is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures during BLE Bluetooth Low Energy scanning...

Design/Logic Flaw

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

CVE-2018-1081

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

CVE-2018-1081

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

CVE-2018-1081

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

CVE-2018-1081

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was...

CVE-2018-1081

A vulnerability (CVE-2018-1081) affects Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to the admin via the PayPal Enrol script; the PayPal IPN callback script should only send error emails to the ...

Immunity Canvas: IDRAC_APPWEB_RCE

Name| idracappwebrce ---|--- CVE| CVE-2018-1207 Exploit Pack| CANVAS Description| iDrac8 WebApp RCE Notes| CVE Name: CVE-2018-1207 NOTES: This module exploits a CGI Injection vulnerability in iDRAC8 in order to achieve Remote Code Execution. We upload a shared library that we can then invoke with...

Microsoft Windows - Desktop Bridge Virtual Registry NtLoadKey Arbitrary File ReadWrite Privilege Escalation

Microsoft Windows - Desktop Bridge Virtual Registry NtLoadKey Arbitrary File ReadWrite Privilege Escalation Windows: Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write EoP Platform: Windows 1703 version 1709 seems to have fixed this bug Class: Elevation of Privilege Summary: The...

Microsoft Windows - Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write Privilege Escalation

Windows: Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write EoP Platform: Windows 1703 version 1709 seems to have fixed this bug Class: Elevation of Privilege Summary: The handling of the virtual registry NtLoadKey callback reloads registry hives insecurely leading to arbitrary...

Cross-site Scripting (XSS)

jolokia-core is vulnerable to cross-site scripting XSS attacks. The library does not properly validate the callback request parameter, allowing a malicious user to inject and execute arbitrary Javascript...

Apple iOS 11.2.5 / watchOS 4.2.2 / tvOS 11.2.5 - bluetoothd Memory Corruption Exploit

Exploit for iOS platform in category dos / poc // // main.m // bluetoothdPoC // // Created by Rani Idan. // Copyright © 2018 zLabs. All rights reserved. // import "AppDelegate.h" include extern kernreturnt bootstraplookupmachportt bs, const char servicename, machportt service; / When hijacking...

Apple iOS 11.2.5 / watchOS 4.2.2 / tvOS 11.2.5 bluetoothd Memory Corruption

// // main.m // bluetoothdPoC // // Created by Rani Idan. // Copyright Ac 2018 zLabs. All rights reserved. // import "AppDelegate.h" include extern kernreturnt bootstraplookupmachportt bs, const char servicename, machportt service; / When hijacking session between bluetoothd and client, add...

Apple iOS 11.2.5 / watchOS 4.2.2 / tvOS 11.2.5 - 'bluetoothd' Memory Corruption

// // main.m // bluetoothdPoC // // Created by Rani Idan. // Copyright © 2018 zLabs. All rights reserved. // import "AppDelegate.h" include extern kernreturnt bootstraplookupmachportt bs, const char servicename, machportt service; / When hijacking session between bluetoothd and client, add callba...

Etherpad Lite Access Restriction Bypass Vulnerability

Etherpad Lite is the Etherpad Foundation's suite of open source rich text online collaboration software. A security vulnerability exists in the node/hooks/express/apicalls.js file in versions of Etherpad Lite prior to 1.6.3, which stems from the program failing to handle JSONP correctly.An attack...

Security Onion Solutions Squert Command Execution Vulnerability (CNVD-2018-05761)

Security Onion Solutions Squert is a web application for querying and viewing event data stored in the Shuil database. A security vulnerability exists in the .inc/callback.php file in Security Onion Solutions Squert versions 1.0.1 through 1.6.7. The vulnerability can be exploited to execute...