Microsoft Windows Net-NTLMv2 Reflection DCOM/RPC Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/post/windows/reflectivedllinjection' class MetasploitModule 'Windows Net-NTLMv2 Reflection DCOM/RPC Juicy', 'Description' = %q This module utilizes the...

Microsoft Windows 10 - 'RestrictedErrorInfo' Unmarshal Section Handle Use-After-Free

Windows: RestrictedErrorInfo Unmarshal Section Handle UAF EoP Platform: Windows 10 1709/1809 Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The WinRT RestrictedErrorInfo doesn’t correctly check the validity of a handle to a section...

Microsoft Windows 10 - RestrictedErrorInfo Unmarshal Section Handle Use-After-Free

Microsoft Windows 10 - RestrictedErrorInfo Unmarshal Section Handle Use-After-Free Windows: RestrictedErrorInfo Unmarshal Section Handle UAF EoP Platform: Windows 10 1709/1809 Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The WinRT...

Denial Of Service (DoS)

undertow-core is vulnerable to denial of service DoS attacks. The application calls the JarURLConnection.getLastModified method causes file handle to remain open and leak file descriptors, causing that file to become unavailable for others...

PT-2019-18079 · Libyaml +2 · Yaml-Cpp +2

Name of the Vulnerable Software and Affected Versions: yaml-cpp aka LibYaml-C++ version 0.6.2 Description: An issue in singledocparser.cpp causes a stack exhaustion problem due to recursive stack frames in functions like HandleCompactMap, HandleMap, HandleFlowSequence, HandleSequence, and...

Fedora 28 : curl (2018-fdc4ca8675)

SASL password overflow via integer overflow CVE-2018-16839 - fix use-after-free in handle close CVE-2018-16840 - fix bad arethmetic when outputting warnings to stderr CVE-2018-16842 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2018:3624-1)

This update for curl fixes the following issues : CVE-2018-16839: A SASL password overflow via integer overflow was fixed which could lead to crashes bsc1112758 CVE-2018-16840: A use-after-free in SASL handle close was fixed which could lead to crashes bsc1112758 CVE-2018-16842: A Out-of-bounds...

SUSE SLED15 / SLES15 Security Update : containerd, docker / go (SUSE-SU-2018:4297-1)

This update for containerd, docker and go fixes the following issues : containerd and docker : Add backport for building containerd bsc1102522, bsc1113313 Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. bsc1102522 Enable seccomp support on SLE12 fate325877 Update to...

UBUNTU-CVE-2018-20574

The SingleDocParser::HandleFlowMap function in yaml-cpp aka LibYaml-C++ 0.6.2 allows remote attackers to cause a denial of service stack consumption and application crash via a crafted YAML file...

PT-2018-15444 · Yaml Cpp +2 · Yaml-Cpp +2

Name of the Vulnerable Software and Affected Versions: yaml-cpp version 0.6.2 Description: The issue allows remote attackers to cause a denial of service, resulting in stack consumption and application crash, via a crafted YAML file. This is due to a problem in the SingleDocParser::HandleFlowMap...

LibSass Denial of Service Vulnerability (CNVD-2019-06790)

LibSass is an open source written in C using Sass CSS extension language parser . A security vulnerability exists in the 'handleerror' function of the sasscontext.cpp file in LibSass versions prior to 3.5.5. An attacker can exploit this vulnerability to cause a denial of service with the help of ...

OpenWrt and LEDE Cross-Site Scripting Vulnerabilities

Both OpenWrt and LEDE are Linux operating systems for embedded devices. The systems are capable of providing fully writable file systems and package management. A cross-site scripting vulnerability exists in the 'cgihandlerequest' function in OpenWrt versions 18.06.1 and earlier and LEDE versions...

CVE-2018-19630

cgihandlerequest in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the URI, as demonstrated by a cgi-bin/?XSS URI...

CVE-2018-13334

Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "optionssysname" parameter...

November 13, 2018—KB4467680 (OS Build 10240.18036)

None None...

'DerpTroll' Faces 10 Years in Prison for DDoSing Gaming Sites as a Teen

After a short but disruptive career knocking popular online gaming sites offline for sport, Austin Thompson, a.k.a. “DerpTroll,” has pleaded guilty to hacking charges. He faces a maximum penalty of 10 years prison and a $250,000 fine. Thompson, a 23-year-old Utah resident, made his plea on Tuesda...

CVE-2018-16986

creationtimestamp| type| source ---|---|--- 2018-11-07 10:23:58+00:00| exploited| https://t.me/thehackernews/122...

[ASA-201811-5] libcurl-compat: arbitrary code execution

Arch Linux Security Advisory ASA-201811-5 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16840 Package : libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-800 Summary ======= The package libcurl-comp...

DEBIAN-CVE-2018-16840

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the Curlclose function, the library code first frees a struct without nulling the pointer and might then subsequently...

ALPINE-CVE-2018-16840

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the Curlclose function, the library code first frees a struct without nulling the pointer and might then subsequently...