Quest NetVault Backup Server Process Manager Service NVBUJobCountHistory Get Method SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUJobCountHistory Get method requests. The issue results from...

Quest NetVault Backup Server Process Manager Service NVBUPhaseStatus Acknowledge Method SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUPhaseStatus Acknowledge method requests. The issue results...

iOS/MacOS kernel double free due to IOSurfaceRootUserClient not respecting MIG ownership rules(CVE-2017-13861)

I have previously detailed the lifetime management paradigms in MIG in the writeups for: CVE-2016-7612 https://bugs.chromium.org/p/project-zero/issues/detail?id=926 and CVE-2016-7633 https://bugs.chromium.org/p/project-zero/issues/detail?id=954 If a MIG method returns KERNSUCCESS it means that th...

Foxit Reader XFAScriptObject object remove method remote code execution vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A remote code execution vulnerability exists in the remove method of the XFAScriptObject object in Foxit Reader version 8.3.1.21155, which results from the program failing to properly validate user-submitted data. A...

Foxit Reader XFA Signature object signer method remote code execution vulnerability

Foxit Reader is China's Foxit Foxit Software Corporation, a PDF document reader. A remote code execution vulnerability exists in the signer method of the XFA's Signature object in Foxit Reader version 8.3.1.21155, which results from the program failing to properly validate user-submitted data. A...

jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper

A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper...

OpenJDK: incorrect handling of references in DGC (RMI, 8163958)

It was discovered that the DCG implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

CVE-2017-15708

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

FS Foodpanda Clone 1.0 SQL Injection

...

Napoleon: a new version of Blind ransomware

The ransomware previously known as Blind has been spotted recently with a .napoleon extension and some additional changes. In this post, we'll analyze the sample for its structure, behavior, and distribution method. Analyzed samples 31126f48c7e8700a5d60c5222c8fd0c7 - Blind ransomware the first...

DSMmall Multi-merchant open source mall system check_email method has SQL injection vulnerability

DSMmall multi-commercial open source mall source code is a thinkPHP as the framework for the development of multi-user mall system source code. DSMmall multi-commerce open source mall system checkemail method SQL injection vulnerability. The vulnerability is due to the system fails to effectively...

DSMmall multivendor open source mall system dropcommonmsg method SQL injection vulnerability

DSMmall multi-commercial open source mall source code is a thinkPHP as the framework for the development of multi-user mall system source code. DSMmall multi-commercial open source mall system dropcommonmsg method SQL injection vulnerability. The vulnerability is due to the system fails to...

Recurly gem Server-Side Request Forgery in Resource#find method

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the Resourcefind method that could result in compromise of API keys or other critical resources...

GHSA-X27V-X225-GQ8G Recurly gem Server-Side Request Forgery in Resource#find method

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the Resourcefind method that could result in compromise of API keys or other critical resources...

SQL Injection Vulnerability in EasySNS Community Backend Administrator copyfile Method

EasySNS community group version for the new database architecture and program structure, to group as the basic unit to form an interactive community. There is a SQL injection vulnerability in the copyfile method of the EasySNS Community background administrator, which can be exploited by attacker...

SQL Injection Vulnerability in EasySNS Community Backend Administrator locker method

EasySNS community group version for the new database architecture and program structure, to group as the basic unit to form an interactive community. There is a SQL injection vulnerability in the EasySNS Community background administrator locker method, which can be exploited by attackers to obta...

Ubuntu: Security Advisory (USN-3497-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3497-1 openjdk-7 vulnerabilities

It was discovered that the Smart Card IO subsystem in OpenJDK did not properly maintain state. An attacker could use this to specially construct an untrusted Java application or applet to gain access to a smart card, bypassing sandbox restrictions. CVE-2017-10274 Gaston Traberg discovered that th...

tcmu-runner: qcow handler opens up an information leak via the CheckConfig D-Bus method

A file information leak flaw was found in implementation of the CheckConfig method in handlerqcow.so of the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could use this flaw to leak arbitrary file names which might not be retrievable by non-root user...

tcmu-runner: glfs handler allows local DoS via crafted CheckConfig strings

A flaw was found in the implementation of CheckConfig method in handlerglfs.so of the tcmu-runner daemon. A local, non-root user with access to the D-Bus system bus could send a specially crafted string to CheckConfig method resulting in various kinds of segmentation fault...