Uniview - Remote Command Execution / Export Config (PoC)

STX Subject: Uniview RCE and export config PoC Researcher: bashis October 2017 Attack Vector: Remote Authentication: Anonymous no credentials needed Export config http://IP:PORT/cgi-bin/main-cgi?json="cmd":255,"szUserName":"","u32UserLoginHandle":-1 -tcpdump- check active capture...

Windows NTLM Auth Hash Disclosure / Denial Of Service Vulnerabilities

Under certain circumstances a shared folder on Windows can be abused remotely to obtain the user credentials and to freeze the machine. Hello, I want to share some information with the people on the list. On May 24, I found a problem with NTLM auth on Windows. Under certain circumstances a shared...

chromium-browser: null pointer dereference in imagecapture

A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka an ImageCapture NULL pointer dereference...

Sky Catchers App has an overstepping access vulnerability

Daily Catch App is an O2O crane catching software. Daily Catch App has an over-the-horizon access vulnerability that allows an attacker to log into the system and obtain sensitive information by catching packets and modifying IDs...

FBI Asks Businesses to Share Details About DDoS Attacks

The FBI has made an appeal to organizations victimized by DDoS attacks to share details and characteristics of those incidents, echoing a similar plea made last year in the throes of a relentless wave of ransomware attacks. The bureau said victims should contact local field offices regardless of...

The Little Lord App has a logical design flaw

Little Lord App is a software focused on women's great aunt menstrual period management. There are vulnerabilities in the logic design of Little Master App that allow an attacker to register any user and reset any user's password by grabbing packets...

Worry-Free Waterkeeper App Has Logic Design Flaws

Worry-free Water Manager App is a real-time query for enterprises to provide sewage treatment system data, operational status visualization management software. Worry-Free Water Manager App has a logical design loophole that allows an attacker to log in to any user account by grabbing packets...

Yikang to Home Android APP has arbitrary cell phone number login vulnerability

Yikang to Home Android APP is mobile online pharmacy shopping software. There is an arbitrary cell phone number login vulnerability in Yikang to Home Android APP. An attacker can log in to any account by capturing a packet and obtaining a verification code...

Arbitrary Account Registration and Password Reset Vulnerabilities in Tea Merchant APP

Tea Merchant APP is a software specialized in serving tea merchants. Tea Merchant APP has arbitrary account registration and password reset vulnerabilities. Attackers can register any account and reset any password by capturing packets and bursting the verification code...

Arbitrary User Registration Vulnerability in Healthcare Hospital App

Jianqi Hospital APP is a health service APP which integrates various forms of services such as "Ask Doctor + Self-diagnosis + Online Drug Purchase" and so on. There is an arbitrary user registration vulnerability in Jianke Hospital APP. Attackers can register any account by capturing packets and...

Best Clinical Practice App Has Arbitrary Registration Account and Arbitrary Password Reset Vulnerabilities

The Best Clinical Practice App is an application designed to provide medical practitioners with knowledge of diagnosis and treatment during clinical practice and learning. The Best Clinical Practice APP is vulnerable to arbitrary account registration and arbitrary password reset. An attacker can...

Multiple Vulnerabilities in Photo Composer App

Picture Synthesizer APP is a picture synthesizer mobile software. Picture Synthesizer APP has arbitrary account registration and arbitrary password reset vulnerabilities. An attacker can register any account and reset any password by grabbing packets to get the verification code...

Dictionary of Medicine App is vulnerable to arbitrary account registration

Pharmaceutical Dictionary APP is a Chinese-English translation dictionary software for medical, pharmaceutical and other professionals under Medical Pulse. There is a logical design vulnerability in Dictionary of Medicine APP. An attacker can register any account by grabbing packets to get the...

Dual Opening Assistant App has a logical design flaw

Double Open Assistant APP is a game assistance application. There is a logical design vulnerability in Dual Open Assistant APP. Attackers can arbitrarily register users and reset arbitrary passwords by capturing packets to obtain verification codes...

FormBook—Cheap Password Stealing Malware Used In Targeted Attacks

It seems sophisticated hackers have changed the way they conduct targeted cyber operations—instead of investing in zero-days and developing their malware; some hacking groups have now started using ready-made malware just like script kiddies. Possibly, this could be a smart move for state-sponsor...

CVE-2017-1000094

Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a Docker Registry. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid...

Design/Logic Flaw

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part...

CVE-2017-1000085

Subversion Plugin connects to a user-specified Subversion repository as part of form validation e.g. to retrieve a list of tags. This functionality improperly checked permissions, allowing any user with Item/Build permission but not Item/Configure to connect to any web server or Subversion server...

CVE-2017-1000091

GitHub Branch Source Plugin connects to a user-specified GitHub API URL e.g. GitHub Enterprise as part of form validation and completion e.g. to verify Scan Credentials are correct. This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect...

CVE-2017-1000085

CVE-2017-1000085 affects the Jenkins Subversion Plugin. The vulnerability arises when the Subversion plugin connects to a user-specified repository during form validation, bypassing Item/Configure permissions and allowing users with Item/Build permission (but not Item/Configure) to have the plugi...