WordPress Fastest Cache 0.8.9.0 Arbitrary File Deletion Exploit

WordPress WP Fastest Cache plugin versions 0.8.9.0 and below suffer from an arbitrary file deletion vulnerability. The wordpress plugin "WP Fastest Cache" 0 suffered from an arbitrary file deletion bug. Description A successful attack allows an unauthenticated attacker to specify a path to a...

WordPress WP Fastest Cache 0.8.9.0 Arbitrary File Deletion

The wordpress plugin "WP Fastest Cache" 0 suffered from an arbitrary file deletion bug. Description A successful attack allows an unauthenticated attacker to specify a path to a directory from which files and directories will be deleted recursively. The vulnerable code path extracts the path...

Important: kernel

Issue Overview: In the Linux kernel afalgrelease in crypto/afalg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free UAF in sockfssetattr. A local attacker can use this flaw to escalate privileges and take control of the system.CVE-2019-8912 Affected...

Carbon Black Cybersecurity Experts to Present in 4 Sessions at RSA 2019

We hope you’ll join Carbon Black at one of the company’s four presentations at RSA 2019. And don’t forget the company will also host a book launch and advanced signing of “Gray Day: My Undercover Mission to Expose America’s First Cyber Spy,” with Carbon Black’s National Security Strategist and...

Martian Vulnerability Chronicles

Well, there should have been an optimistic post about my vulnerability analysis & classification pet-project. Something like "blah-blah-blah the situation is pretty bad, tons of vulnerabilities and it's not clear which of them can be used by attackers. BUT there is a way how to make it better usi...

Medium: php-pear

Issue Overview: PEAR ArchiveTar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the ArchiveTar class. There are several file operations with $vheader'filename' as parameter such as fileexists, isfile, isdir, etc. When extract is called without a specific prefix path, we can...

Low: libXcursor

Issue Overview: XcursorThemeInherits in library.c in libXcursor allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow. CVE-2015-9262 Affected Packages: libXcursor Issue Correction: Run yum update libXcursor or yum update --advisory...

Medium: curl

Issue Overview: setfilemetadata in xattr.c in GNU Wget stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information e.g., credentials contained in the URL by reading this...

R 3.5.0 - Local Buffer Overflow (SEH) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: R i386 3.5.0 - Local Buffer Overflow SEH Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://www.r-project.org/ Version: 3.5.0 Software Link:...

UltraISO 9.7.1.3519 - 'Output FileName' Local Buffer Overflow (SEH)

!/usr/bin/python Exploit Title: UltraISO 9.7.1.3519 - Local Buffer Overflow SEH Date: 30/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://www.ultraiso.com/ Version: 9.7.1.3519 Software Link: https://www.ultraiso.com/download.html Contact: [email protected]...

Anyburn 4.3 - Convert image to file format Denial of Service Exploit

!/usr/bin/python Exploit Title: AnyBurn x86 - Denial of Service DoS Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: http://www.anyburn.com/ Version: 4.3 32-bit Software Link : http://www.anyburn.com/anyburnsetup.exe Contact: [email protected] Twitter: @telspacesystems Gree...

HTML5 Video Player 1.2.5 - Local Buffer Overflow (Non SEH)

!/usr/bin/python Exploit Title: HTML5 Video Player 1.2.5 - Local Buffer Overflow - Non SEH Date: 27/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: http://www.html5videoplayer.net/download.html Software: http://www.html5videoplayer.net/html5videoplayer-setup.exe Contact:...

R 3.4.4 XP SP3 - Buffer Overflow (Non SEH) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: R 3.4.4 - Local Buffer Overflow Windows XP SP3 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://cloud.r-project.org/bin/windows/ Contact: [email protected] Twitter:...

R 3.4.4 XP SP3 - Buffer Overflow (Non SEH)

R 3.4.4 XP SP3 - Buffer Overflow Non SEH !/usr/bin/python Exploit Title: R 3.4.4 - Local Buffer Overflow Windows XP SP3 Date: 21/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://cloud.r-project.org/bin/windows/ Contact: [email protected] Twitter:...

R 3.4.4 Local Buffer Overflow

!/usr/bin/python Exploit Title: R 3.4.4 - Local Buffer Overflow Windows XP SP3 Date: 21/01/2019 Exploit Author: Dino Covotsos - Telspace Systems Vendor Homepage: https://cloud.r-project.org/bin/windows/ Contact: [email protected] Twitter: @telspacesystems Version: 3.4.4 Tested on: Windows X...

Lua 5.3.5 Use-After-Free

Exploit Title: Lua 5.3.5 Exploit Author: Fady Mohamed Osman https://twitter.com/fadyothman Exploit-db : http://www.exploit-db.com/author/?a=2986 Blog : https://blog.fadyothman.com/ Date: Jan. 10th 2019 Vendor Homepage: https://www.lua.org/ Software Link: https://www.lua.org/ftp/lua-5.3.5.tar.gz...

Low: curl

Issue Overview: A heap use-after-free flaw was found in curl related to closing an easy handle. When closing and cleaning up an 'easy' handle in the Curlclose function, the library code first frees a struct without nulling the pointer and might then subsequently erroneously write to a struct fiel...

Starbucks: Information Exposure Through an Error Message at news.starbucks.com

I've discovered Information Exposure Through an Error Message on your system POC link: https://news.starbucks.com/cms/index.php?/cp/login/forgottenpasswordform=http://evil.com/?id=test-test Vulnerable url --...

OpenSource ERP 6.3.1. - SQL Injection

OpenSource ERP 6.3.1. - SQL Injection Exploit Title: OpenSource ERP SQL Injection Date: 10.01.2019 Exploit Author: Emre ÖVÜNÇ Vendor Homepage: http://www.nelson-it.ch Software Link: http://sourceforge.net/projects/opensourceerp/files/Windows/erp6.3.1.exe/download Version: v6.3.1 Tested on: Window...

BMC Remedy / ITAM 7.1.00 / 9.1.02.003 Information Disclosure

Intro: Multiple security related issues were identified in the BMC Remedy + ITAM, versions 7.1.00 and 9.1.02.003 were confirmed to be vulnerable. Issues: 1. Authenticated users can access ITAM forms using forceful browsing, i.e. the forms are not accessible in the ITAM web user interface. The lis...