Morris Worm - sendmail Debug Mode Shell Escape (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'expect' class MetasploitModule 'Morris Worm sendmail Debug Mode Shell Escape', 'Description' = %q This module exploits sendmail's well-known historical debug mo...

UPDATED VERSION: RouterSploit 3.4.0

PenTestIT RSS Feed RouterSploit 3.4.0, the long awaited router exploitation framework update is out guys! This release includes some really cool features and updates such as using pycryptodome from pycryptoand newer exploitation modules! Read on for the improvements. What is RouterSploit? The...

blueimp's jQuery (Arbitrary) File Upload

This module exploits an arbitrary file upload in the sample PHP upload handler for blueimp's jQuery File Upload widget in versions use exploit/unix/webapp/jquery/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf undefinedfileupload show options...

Google PDFium JBIG2 image ComposeToOpt2WithRect information disclosure vulnerability

Summary An exploitable out-of-bounds read on the heap vulnerability exists in the JBIG2 parsing code of Google Chrome version 67.0.3396.99. A specially crafted PDF document can trigger an out-of-bounds read, which can possibly lead to an information leak that could be used as part of an exploit. ...

UBUNTU-CVE-2018-15919

Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration or...

PT-2018-2784

Name of the Vulnerable Software and Affected Versions OpenSSH versions through 7.8 Description The issue is related to the auth-gss2.c file in OpenSSH, which lacks protection of service data. This could allow a remote attacker to disclose protected information. Additionally, remotely observable...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3753-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3753-2 advisory. USN-3753-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

RouterSploit v3.3.0 - Exploitation Framework For Embedded Devices

The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices. It consists of various modules that aids penetration testing operations: exploits - modules that take advantage of identified vulnerabilities creds - modules designed to test credentials against...

Linux Kernel 4.14.7 (Ubuntu 16.04 / CentOS 7) - (KASLR & SMEP Bypass) Arbitrary File Read

// A proof-of-concept exploit for CVE-2017-18344. // Includes KASLR and SMEP bypasses. No SMAP bypass. // No support for 1 GB pages or 5 level page tables. // Tested on Ubuntu xenial 4.4.0-116-generic and 4.13.0-38-generic // and on CentOS 7 3.10.0-862.9.1.el7.x8664. // // gcc pwn.c -o pwn // // ...

generic-drugs.biz XSS vulnerability

Open Bug Bounty ID: OBB-644180 Description| Value ---|--- Affected Website:| generic-drugs.biz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Ubuntu: Security Advisory (USN-3696-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KVM (Nested Virtualization) - L1 Guest Privilege Escalation Vulnerability

Exploit for linux platform in category dos / poc When KVM on Intel virtualizes another hypervisor as L1 VM it does not verify that VMX instructions from the L1 VM which trigger a VM exit and are emulated by L0 KVM are coming from ring 0. For code running on bare metal or VMX root mode this is...

Security Bulletin: IBM MQ and IBM MQ Appliance MQOPEN call might succeed when it should have failed. (CVE-2017-1341 )

Summary MQOPEN call might succeed when it should have failed, when using generic profile authority matching for remotely defined MQ object. Vulnerability Details CVEID: CVE-2017-1341 DESCRIPTION: IBM WebSphere MQ could allow, under special circumstances, an unauthorized user to access an object...

OpenJDK: GSS context use-after-free (JGSS, 8186212)

It was discovered that the JGSS component of OpenJDK failed to properly handle GSS context in the native GSS library wrapper in certain cases. A remote attacker could possibly make a Java application using JGSS to use a previously freed context...

Exploitation Framework for Embedded Devices: RouterSploit

The RouteSploit Framework is an open-source exploitation framework dedicated to embedded devices. The RouteSploit Framework consists of various modules that aids penetration testing operations: exploits – modules that take advantage of identified vulnerabilities creds – modules designed to test...

best-generic-drugs.net XSS vulnerability

Open Bug Bounty ID: OBB-602031 Description| Value ---|--- Affected Website:| best-generic-drugs.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-9372

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.18 through 4.16 Description The Linux Kernel incorrectly handles an SG IO ioctl on /dev/sg0 with dxfer direction=SG DXFER FROM DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the...

CVE-2017-13272

In alarmreadygeneric of alarm.cc, there is a possible out of bounds write due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0,...

USN-3613-1 openjdk-8 vulnerabilities

It was discovered that a race condition existed in the cryptography implementation in OpenJDK. An attacker could possibly use this to expose sensitive information. CVE-2018-2579 It was discovered that the Hotspot component of OpenJDK did not properly validate uses of the invokeinterface JVM...

xpdf denial of service vulnerability (CNVD-2018-06676)

Xpdf is an open source PDF file viewer, this software runs on X Window as well as Motif. xpdf also runs on all classes of Unix operating systems. xpdf 4.00 in the JBIG2Stream.cc in the JBIG2Stream::readGenericBitmap function there is a denial of service vulnerability. An attacker can exploit this...