Microsoft Word (Windows/OSX) - Crash (PoC)

Source: https://twitter.com/halsten/status/740380171694280704 Win/Mac MSFT Word 0day POC having 3 different forced triggers. Happy exploitation! Let Word recover it, its essential, and then you can trigger the bug afterwards in 3 ways, Save, Close/Save, change format. Proof of Concept:...

kernel security and bug fix update

3.10.0-327.18.2.OL7 - Oracle Linux certificates Alexey Petrenko 3.10.0-327.18.2 - lib keys: Fix ASN.1 indefinite length object parsing David Howells 1308814 1308815 CVE-2016-0758 3.10.0-327.18.1 - scsi bnx2fc: Fix FCP RSP residual parsing Maurizio Lombardi 1322279 1306342 - mm madvise: fix...

用友某系统多处注入漏洞打包

简要描述： wooyun搜了一下，没有人提，来一发。 详细说明： 首先，该接口是无需权限访问的。 已http://.../bugs/wooyun-2010-0178322为例： ...:8080/uapws/service/nc.itf.bd.crm.ICurrtypeExportToCrmService?wsdl ...:8080/uapws/service/nc.itf.bd.crm.IInvbasdocExportToCrmService?wsdl ...:8080/uapws/service/nc.itf.bd.crm.IMeasdocExportToCrmService?wsd...

CVE-2016-0785

Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%" sequence in a tag attribute, aka forced double OGNL evaluation...

PT-2016-1671

Name of the Vulnerable Software and Affected Versions Apache Struts versions prior to 2.3.28 Apache Struts 2.x before 2.3.20.3 Apache Struts 2.x before 2.3.24.3 Description The issue allows remote attackers to execute arbitrary code via a %" sequence in a tag attribute, also known as forced doubl...

CVE-2016-0785: Improper Input Validation

Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%" sequence in a tag attribute, aka forced double OGNL evaluation...

PT-2016-3206

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.x through 2.3.28 Description The issue allows remote attackers to execute arbitrary code via a % sequence in a tag attribute, also known as forced double OGNL evaluation. This is due to insufficient input validation. T...

OpenSSH <= 7.2p1 Xauth Command Injection Vulnerability

OpenSSH is prone to an xauth command injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...

OpenSSH 7.2p1 - Authenticated xauth Command Injection

Exploit for multiple platform in category remote exploits ''' Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview -------- Name: openssh Vendor:...

OpenSSH <=7.2p1 xauth injection

来源链接： https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 VuNote Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview Name: openssh...

OpenSSH 7.2p1 - (Authenticated) xauth Command Injection

''' Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview -------- Name: openssh Vendor: OpenBSD References: http://www.openssh.com/1 Version: 7.2...

OpenSSH 7.2p1 xauth Command Injection / Bypass

Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115 Version: 0.2 Date: Mar 3rd, 2016 Tag: openssh xauth command injection may lead to forced-command and /bin/false bypass Overview -------- Name: openssh Vendor: OpenBSD References: http://www.openssh.com/1 Version: 7.2p1 2...

Dropbear SSHD xauth Command Injection / Bypass

Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3116 Version: 0.2 Date: Mar 3rd, 2016 Tag: dropbearsshd xauth command injection may lead to forced-command bypass Overview -------- Name: dropbear Vendor: Matt Johnston References: https://matt.ucc.asn.au/dropbear/dropbear.ht...

The vulnerability of the Cisco Identity Services Engine, a platform for managing network policies, allows a hacker to deploy malicious elements on a page and force the user to activate them.

The vulnerability of the Cisco Identity Services Engine web interface interface is related to the lack of restrictions on the use of IFRAME elements. Exploiting this vulnerability allows a malicious actor to deploy malicious elements on the page and force users to activate them through a speciall...

DropBearSSHD 2015.71 - Command Injection

DropBearSSHD 2015.71 - Command Injection VuNote ============ Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3116 Version: 0.2 Date: Mar 3rd, 2016 Tag: dropbearsshd xauth command injection may lead to forced-command bypass Overview -------- Name: dropbear Vendor: Matt...

DropBearSSHD 2015.71 - Command Injection

Exploit for linux platform in category remote exploits VuNote ============ Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3116 Version: 0.2 Date: Mar 3rd, 2016 Tag: dropbearsshd xauth command injection may lead to forced-command bypass Overview -------- Name: dropbear...

OracleVM 3.2 : openssh (OVMSA-2016-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - change default value of MaxStartups - CVE-2010-5107 John Haxby - improve RNG seeding from /dev/random 681291,708056 - make ssh1's ConnectTimeout option apply to both the TCP connection and SSH banner...

jenkins: forced API token change (SECURITY-180)

A flaw was found in the Jenkins API token-issuing service. The service was not properly protected against anonymous users, potentially allowing remote attackers to escalate privileges...

openssh security, bug fix, and enhancement update

6.6.1p1-22 - Use the correct constant for glob limits 1160377 6.6.1p1-21 - Extend memory limit for remote glob in sftp acc. to stat limit 1160377 6.6.1p1-20 - Fix vulnerabilities published with openssh-7.0 1265807 - Privilege separation weakness related to PAM support - Use-after-free bug related...

This Malware Can Secretly Auto-Install any Android App to Your Phone

Own an Android Smartphone? Hackers can install any malicious third-party app on your smartphone remotely even if you have clearly tapped a reject button of the app. Security researchers have uncovered a trojanized adware family that has the capability to automatically install any app on an Androi...