RARLAB WinRAR ACE Format Input Validation Remote Code Execution

In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format in UNACEV2.dll. When the filename field is manipulated with specific patterns, the destination extraction folder is ignored, thus treating the filename as an...

PT-2019-1468

Name of the Vulnerable Software and Affected Versions WinRAR versions prior to and including 5.61 Description The issue is related to a path traversal vulnerability in the unacev2.dll library of WinRAR, which occurs when the filename field of the ACE format is crafted in a specific way. This allo...

NeDi Detection

Detection of NeDi. The script sends a connection request to the server and attempts to detect NeDi and to extract its version. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Killcast - Manipulate Chromecast Devices In Your Network

Manipulate Chromecast Devices in your Network. Inspiration - Thousands of Google Chromecast Devices Hijacked to Promote PewDiePie This tool is a Proof of Concept and is for Research Purposes Only, killcast shows how Chromecast devices can be easily manipulated and hijacked by anyone. Features...

SQLMap v1.3 - Automatic SQL Injection And Database Takeover Tool

SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lastin...

EulerOS 2.0 SP5 : openssl (EulerOS-SA-2019-1009)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to...

BMC Network Automation Detection

Detection of BMC Network Automation The script sends a HTTP connection request to the server and attempts to detect BMC Network Automation and to extract its version. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C...

Fedora 28 : mkvtoolnix (2018-317ecbb54f)

Version 28.2.0 'The Awakening' 2018-10-25 Bug fixes - mkvmerge, mkvinfo, mkvextract, mkvpropedit, MKVToolNix GUI's info tool & chapter editor: fixed a case of memory being accessed after it had been freed earlier. This can be triggered by specially crafted Matroska files and lead to arbitrary cod...

UBUNTU-CVE-2018-20662

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing...

Node.js third-party modules: [bower] Arbitrary File Write through improper validation of symlinks while package extraction

I would like to report file write in arbitrary locations via install command in bower It allows attackers to write arbitrary files when a malicious package is extracted. Module module name: bower version: 1.8.4 npm page: https://www.npmjs.com/package/bower Module Description Bower offers a generi...

DEBIAN-CVE-2018-1000888

PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations with $vheader'filename' as parameter such as fileexists, isfile, isdir, etc. When extract is called without a specific prefix path, we can trigger...

EulerOS 2.0 SP2 : openssl (EulerOS-SA-2018-1420)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to...

ABB M2M ETHERNET Detection

Detection of ABB M2M ETHERNET. The script sends a connection request to the server and attempts to detect ABB M2M ETHERNET and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

A Post-Exploitation Scanning/Mapping Tool: Scavenger

SCAVENGER is a multi-threaded post-exploitation scanning tool for mapping systems and finding “interesting” and most frequently used files, folders and services. Once credentials are gained, it can scan remote systems Linux, Windows and OSX via services like SMB and SSH to scrape that system...

CVE-2018-16868

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade...

UBUNTU-CVE-2018-16869

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases...

MCExtractor - Intel, AMD, VIA & Freescale Microcode Extraction Tool

Intel, AMD, VIA & Freescale Microcode Extraction Tool MC Extractor News Feed MC Extractor Discussion Topic Intel, AMD & VIA CPU Microcode Repositories A. About MC Extractor MC Extractor is a tool which parses Intel, AMD, VIA and Freescale processor microcode binaries. It can be used by end-users...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20181030)

Security Fixes : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to client during DHE TLS handshake causing the client to hang CVE-2018-0732 - openssl: Handling of crafted recursive ASN.1 structures can cau...

Heap-based Buffer Overflow

libarchive.so is vulnerable to heap-based buffer overflow. The lack of size check in the parsefileinfo function of archivereadsupportformatiso9660.c allows the attack when a malicious iso9660 ISO file gets extracted...

SQL Injection Vulnerability in Automotive Industry Management System of Shijiazhuang Dr. Tak Software Technology Development Co.

Shijiazhuang Dr. Tak Software Technology Development Co., Ltd. is one of the scientific research developers of business management software. A SQL injection vulnerability exists in the automotive industry management system of Shijiazhuang Dr. Tak Software Technology Development Co. The...