Dropbox: Local Privilege Escalation on Dropbox Desktop for Windows

This report describes a local privilege escalation in the Dropbox automatic updater process on Windows. It would allow a malicious actor who had already gained non-admin access to a Windows computer to obtain admin privileges, if Dropbox had previously been installed with admin privileges. This...

FAQ: Licensing for Disaster Recovery Servers

Q: Can existing licenses in the production environment be used for a Disaster Recovery Server? A: Yes, it is possible to use the same server/farm licenses in another server/farm if it is a disaster recovery server/farm. Q: Can both Production and Disaster Recovery servers run simultaneously? A: N...

CVE-2019-10773

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set...

DEBIAN-CVE-2019-14896

A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service system crash or, possibly execute arbitrary code, when the lbsibssjoinexisting function is called after a STA connects to...

PT-2019-5129 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel version kernel-2.6.32 Description: A stack-based buffer overflow was found in the Linux kernel's Marvell WiFi chip driver. This issue can cause a denial of service system crash or possibly allow the execution of arbitrary code wh...

Arbitrary File Overwrite

github.com/containers/libpod is vulnerable to arbitrary file overwrite. The vulnerability exists as it does not properly perform symlink processing and wild-card characters parsing, allowing for overwriting of existing files when an undesired glob operation occurs...

AppTrana — Website Security Solution That Actually Works

Data loss and theft continues to rise, and hardly a day goes by without significant data breaches hit the headlines. In January 2019 alone, 1.76 billion records were leaked, and according to IBM's Data Breach study, the average cost of each lost or stolen record has reached about $148. Most of...

PT-2019-12364 · Pulse · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions 9.0RX before 9.0R3.4 Pulse Connect Secure versions 8.3RX before 8.3R7.1 Pulse Connect Secure versions 8.2RX before 8.2R12.1 Description: The issue affects users of SAML authentication with the Reuse Existing NC...

CVE-2019-11471

libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::setalphachannel in heifcontext.h because heifcontext.cc mishandles references to non-existing alpha images...

CVE-2019-9939

The SHAREit application before 4.0.36 for Android allows a remote attacker on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated to bypass authentication by trying to fetch a non-existing page. When the non-existing page is requeste...

Linux kernel denial of service vulnerability (CNVD-2019-07810)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the 'inotifyupdateexistingwatch' function in the Linux kernel. An attacker can exploit this vulnerability to cause a denial of servi...

The vulnerability of the Symfony software platform for developing and managing web applications lies in errors in processing user authentication data, allowing attackers to bypass the authentication process.

The vulnerability of the Symfony software platform for developing and managing web applications is related to errors in processing user authentication data. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures by using the user’s existing username and an empt...

Sales & Company Management System Privilege Permission and Access Control Vulnerability

Sales & Company Management System SCMS is a sales and company management system. The system includes features such as customer management, product management and tax management. A privilege permission and access control vulnerability exists in SCMS 2018-06-06 and prior versions, which can be...

CVE-2018-19046

keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name e.g., /tmp/keepalived.data or /tmp/keepalived.stats, with read access for the attacker and...

Shining a Light on a New Technique for Stealth Persistence

Red teamers like myself and my team are driven by a desire to out-innovate the bad guys – to help the good guys. We study their methods, strive to think like they do, work to better understand attacker techniques and test our mettle against the spectrum of technologies in use today to find new wa...

CVE-2018-8852

Philips e-Alert Unit non-medical device, Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives an attacker the opportunity to steal authenticated sessions without invalidating any existing session identifier...

Provisioning services--Connection Timeout Expired when adding a new server to an existing farm

The following error can be seen trying to add a PVS server to an exisiting farm. "Connection timeout expired. The timeout period elapsed while attempting to consume the pre-login handshake acknowledgement. The could be because the pre-login handshake failed or the server was unable to respond pac...

When propagating the changes from storefront server, getting Event ID 31.

" An error has occurred during the all server configuration update process. An error occurred running the command: 'Add-DSFeatureInstances' The element identified by the instruction 'addElement' at 6,4 with attribute 'xpath', value '/configuration/container/componenets', already exists At line:1...

CVE-2018-12713

GIMP through 2.10.2 makes ggettmpdir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimpwriteandreadfile function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was...

ClipperCMS Session Fixation Vulnerability

ClipperCMS is a content management system CMS. A security vulnerability exists in ClipperCMS version 1.3.3. An attacker can exploit the vulnerability to allow a user to use a pre-existing session ID or hijack a user session...