Server side request forgery (ssrf)

InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request...

CVE-2020-24765: Direct Request

InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request...

CVE-2020-1671: Improper Restriction of Operations within the Bounds of a Memory Buffer

On Juniper Networks Junos OS platforms configured as DHCPv6 local server or DHCPv6 Relay Agent, Juniper Networks Dynamic Host Configuration Protocol Daemon JDHCPD process might crash with a core dump if a malformed DHCPv6 packet is received, resulting with the restart of the daemon. This issue on...

Metasploit Wrap-Up

Windows secrets dump The following provided by Christophe De La Fuente! A common pen testing pattern is to compromise a local administrative account on a host and use it to grab Windows password hashes, kerberos tickets, and other secrets stored locally. The most common technique is to run tools...

Windows Secrets Dump

Dumps SAM hashes and LSA secrets including cached creds from the remote Windows target without executing any agent locally. This is done by remotely updating the registry key security descriptor, taking advantage of the WriteDACL privileges held by local administrators to set temporary read...

CVE-2020-8887

The CVE-2020-8887 entry concerns Telestream Tektronix Medius (and Sentry) before version 10.7.5, affected by an SQL injection in the login flow. Specifically, an unauthenticated attacker can dump database contents by manipulating the page parameter in a login request to index.php. The root cause ...

XCloner Backup and Restore 4.2.1 - 4.2.12 - Unprotected AJAX Action

"This flaw gave authenticated attackers, with subscriber-level or above capabilities, the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution on a vulnerable site’s server. Alternatively, an attacker could create an exploit cha...

Information disclosure

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key TK prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific...

CVE-2020-7299 Sensitive Data Exposure vulnerability in McAfee True Key Windows Client

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key TK prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific...

CVE-2020-7299

CVE-2020-7299 affects the McAfee True Key Windows client. The vulnerability is a cleartext storage of sensitive information in memory, enabling a local administrator to access another user’s passwords on the same machine by triggering a process dump. Affected are True Key versions prior to 6.2.10...

CVE-2020-7299: Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key TK prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific...

LDAP Information Disclosure

This module uses an anonymous-bind LDAP connection to dump data from an LDAP server. Searching for attributes with user credentials e.g. userPassword. Module Options msf use auxiliary/gather/ldaphashdump msf auxiliaryldaphashdump show actions ...actions... msf auxiliaryldaphashdump set ACTION msf...

CVE-2020-5912

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files...

CVE-2020-24315

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

Design/Logic Flaw

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

CVE-2020-5912: Undefined Security Weakness

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the restjavad process's dump command does not follow current best coding practices and may overwrite arbitrary files...

CVE-2020-24315: Improper Neutralization of Special Elements used in an SQL Command

Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database...

VolExp - Volatility Explorer

This program allows the user to access a Memory Dump. It can also function as a plugin to the Volatility Framework https://github.com/volatilityfoundation/volatility. This program functions similarly to Process Explorer/Hacker, but additionally it allows the user access to a Memory Dump or access...

Metasploit Framework Relative Path Traversal Vulnerability

Metasploit Framework is a modular Ruby-based penetration testing platform that enables you to write, test and execute exploit code. A relative path traversal vulnerability exists in the untar method of the "auxiliary/admin/http/telpho10credentialdump" module of the Metasploit Framework, which can...

CVE-2020-7377

The Metasploit Framework module "auxiliary/admin/http/telpho10credentialdump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP...