Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Gitlab

It is an open-source collection of pre-built vulnerable docker environments. The repository contains various vulnerable environments, each with its own set of vulnerabilities, allowing users to test and learn about different types of attacks. The environments are built using Docker and Docker...

Microsoft Patch Tuesday September 2020: Zerologon and other exploits, RCEs in SharePoint and Exchange

I would like to start this post by talking about Microsoft vulnerabilities, which recently turned out to be much more serious than it seemed at first glance. Older Vulnerabilities with exploits "Zerologon" Netlogon RCE CVE-2020-1472 One of them is, of course, the Netlogon vulnerability from the...

Exploitability Analysis: Smash the Ref Bug Class

In April 2020, security researcher Gil Dabah published a paper on a set of vulnerabilities he had discovered within the Win32k subsystem of the Windows operating system. These vulnerabilities demonstrated instances of a new class of bugs, dubbed “Smash the Ref.” Dabah’s research included 13 test...

GLSA-202009-13 : Chromium, Google Chrome: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202009-13 Chromium, Google Chrome: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details. Impact : Please review the...

Photon OS 3.0: Linux PHSA-2020-3.0-0145

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0145. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid141094;...

Vulmap

This is a vulnerability scanner tool called Vulmap, developed by vulmon. It is an open-source online local vulnerability scanner project that scans installed software on a host and checks for vulnerabilities against the vulmon API. The tool can be used for defensive and offensive purposes,...

CVE-2020-15214

In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the...

Metasploit Wrap-up

Nine! Nine new modules! Ah ha ha! With the coming of autumn here in the Northern hemisphere, the nights are getting longer, and the hacking is getting stronger. We’ve really got something for everybody in this release, from IoT to infrastructure, Windows, and Linux; everyone’s pretty...

CVE-2020-15212 Out of bounds access in tensorflow-lite

In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to segmentidsdata can alter outputindex and then write to outside of outputdata...

CVE-2020-15214 Out of bounds write in tensorflow-lite

In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the...

Exploit for OS Command Injection in Secudos Domos

CVE-2020-14293 This vulnerablity was discovered and disclosed...

Fedora 32 : zeromq (2020-08402f4071)

Fix for 1876738 and 1876689 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

DHS Issues Dire Patch Warning for ‘Zerologon’

Federal agencies that haven’t patched their Windows Servers against the ‘Zerologon’ vulnerability by Monday Sept. 21 at 11:59 pm EDT are in violation of a rare emergency directive issued by the Secretary of Homeland Security. With only hours until the deadline for the directive, issued on Friday,...

FreeBSD : samba -- Unauthenticated domain takeover via netlogon (24ace516-fad7-11ea-8d8c-005056a311d1)

The Samba Team reports : An unauthenticated attacker on the network can gain administrator access by exploiting a netlogon protocol flaw. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020...

Photon OS 2.0: Linux PHSA-2020-2.0-0283

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0283. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid140709...

Amazon Linux 2 : lua53 (ALAS-2020-1492)

The version of lua53 installed on the remote host is prior to 5.3.5-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1492 advisory. ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31...

OPENSUSE-SU-2020:1439-1 Security update for mumble

This update for mumble fixes the following issues: mumble was updated 1.3.2: client: Fixed overlay not starting Update to upstream version 1.3.1 - Security Fixed: Potential exploit in the OCB2 encryption 4227 boo1174041 - ICE Fixed: Added missing UserKDFIterations field to UserInfo = Prevents...

Iran-Based Threat Actor Exploits VPN Vulnerabilities

Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. This product was written by the Cybersecurity and Infrastructure Security Agency CISA with contributions...

GLSA-202009-10 : PHP: Denial of service

The remote host is affected by the vulnerability described in GLSA-202009-10 PHP: Denial of service It was discovered that PHP did not properly handle PHAR files. Impact : A remote attacker could entice a user to open a specially crafted PHAR file using PHP, possibly allowing attacker to obtain...

exploit-database

This is the official Exploit Database repository, a collection of public exploits and vulnerable software. The repository is maintained by Offensive Security and is updated daily with new submissions. The database contains a wide range of exploits, including remote code execution, privilege...