OpenNetAdmin 18.1.1 Remote Code Execution

Exploit Title: OpenNetAdmin 18.1.1 - Remote Code Execution Date: 2019-11-19 Exploit Author: mattpascoe Vendor Homepage: http://opennetadmin.com/ Software Link: https://github.com/opennetadmin/ona Version: v18.1.1 Tested on: Linux Exploit Title: OpenNetAdmin v18.1.1 RCE Date: 2019-11-19 Exploit...

Centova Cast 3.2.12 - Denial of Service (PoC)

Centova Cast 3.2.12 - Denial of Service PoC Exploit Title: Centova Cast 3.2.12 - Denial of Service PoC Date: 2019-11-18 Exploit Author: DroidU Vendor Homepage: https://centova.com Affected Version: =v3.2.12 Tested on: Debian 9, CentOS 7 =============================================== The Centova...

Centova Cast 3.2.11 - Arbitrary File Download

Centova Cast 3.2.11 - Arbitrary File Download Exploit Title: Centova Cast 3.2.11 - Arbitrary File Download Date: 2019-11-17 Exploit Author: DroidU Vendor Homepage: https://centova.com Affected Version: =v3.2.11 Tested on: Debian 9, CentOS 7 !/bin/bash if "$4" = "" then echo "Usage: $0...

curl security and bug fix update

7.61.1-11 - rebuild with updated annobin to prevent Execshield RPMDiff check from failing 7.61.1-10 - fix SMTP end-of-response out-of-bounds read CVE-2019-3823 - fix NTLMv2 type-3 header stack buffer overflow CVE-2019-3822 - fix NTLM type-2 out-of-bounds buffer read CVE-2018-16890 - xattr: strip...

CVE-2019-5443

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

Critical Photon OS Security Update - PHSA-2019-0255

Updates of 'file', 'git', 'python3', 'libndp', 'curl', 'haproxy', 'libpcap', 'linux', 'tcpdump', 'binutils', 'e2fsprogs', 'linux-esx', 'python2', 'polkit' packages of Photon OS have been released...

Linear eMerge E3 1.00-06 Privilege Escalation

Linear eMerge E3 Privilege Escalation Affected version: =1.00-06 CVE: CVE-2019-7258, CVE-2019-7259 Advisory: https://applied-risk.com/resources/ar-2019-005 by Gjoko 'LiquidWorm' Krstic Escalate: curl "http://192.168.1.2/?c=webuser&m=update" -X POST –-data...

eMerge E3 1.00-06 - Privilege Escalation Vulnerability

Exploit for hardware platform in category web applications Exploit Title: eMerge E3 1.00-06 - Privilege Escalation Exploit Author: LiquidWorm Vendor Homepage: http://linear-solutions.com/nscfamily/e3-series/ Software Link: http://linear-solutions.com/nscfamily/e3-series/ Version: 1.00-06 Tested o...

Linear eMerge E3 1.00-06 Directory Traversal

Linear eMerge E3 Unauthenticated Directory Traversal File Disclosure Affected version: =1.00-06 CVE: CVE-2019-7254 Advisory: https://applied-risk.com/resources/ar-2019-005 by Gjoko 'LiquidWorm' Krstic GET /?c=../../../../../../etc/passwd%00 Host: 192.168.1.2...

EulerOS 2.0 SP5 : curl (EulerOS-SA-2019-2136)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.CVE-2019-5482 - curl before version 7.51.0 uses outdated IDNA 2003...

EulerOS 2.0 SP8 : curl (EulerOS-SA-2019-2101)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.CVE-2019-5481 - Heap buffer overflow in the TFTP protocol handler in...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2019-2252)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.CVE-2019-5482 Note that Tenable Network Security has extracted the precedi...

RHEL 8 : curl (RHSA-2019:3701)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3701 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

curl: NTLM type-2 heap out-of-bounds buffer read

An out-of-bounds read flaw was found in the way curl handled NTLMv2 type-2 headers. When connecting to a remote malicious server which uses NTLM authentication, the flaw could cause curl to crash...

Moderate: Red Hat Security Advisory: curl security and bug fix update

An update for curl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

curl: NTLMv2 type-3 header stack buffer overflow

A stack-based buffer overflow was found in the way curl handled NTLMv2 type-3 headers. When connecting to a remote malicious server which uses NTLM authentication, the flaw could cause curl to crash...

curl: SMTP end-of-response out-of-bounds read

An out-of-bounds read flaw was found in the way curl handled certain SMTP responses. A remote attacker could use this flaw to crash curl...

Scripteen Image Upload Shell Upload

Exploit Title : Scripteen İmage Upload Script Arbitrary File Injection + Venedor Home Page : https://scripteen.com/ + Author : z3r0fy + Twitter : z3r0fy + Website : www.bugcontainer.gq + CX Security Link : https://cxsecurity.com/issue/WLB-2019100145 + Description : Due to these codes in the...

curl: SMB access smuggling via FILE URL on Windows

Summary: While CURL 7.62 parses URLs that have an ? parameter separator char after the fragment separator, CURL urlapi code treats the path with the hash part as it being the same one, this may allow some problem on specific protocols that may have a security impact. On HTTP, an attacker may be...

iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P (get_jpeg) Stream Disclosure

!/bin/bash iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P getjpeg Stream Disclosure Vendor: iSeeQ Product web page: http://www.iseeq.co.kr Affected version: WH-H4 1.03R / 2.0.0.P Summary: The 4/8/16 channel hybrid standalone DVR delivers high quality pictures which adopts high performance video processin...