Apache Struts Security Update (S2-032, S2-033) - Version Check

Apache Struts is prone to multiple arbitrary code execution vulnerabilities. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

Gear S2 Experience - SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Gear S2 Experience published at the 'play' market has multiple vulnerabilities...

Apache Struts 2 跨站脚本漏洞 (S2-030)

No description provided by source...

AIX 7.1 - lquerylv Local Privilege Escalation

AIX 7.1 - lquerylv Local Privilege Escalation !/bin/sh Exploit Title: AIX 7.1 lquerylv privilege escalation Date: 2015.10.30 Exploit Author: S2 Crew Hungary Vendor Homepage: www.ibm.com Software Link: - Version: - Tested on: AIX 7.1 7100-02-03-1334 CVE : CVE-2014-8904 From file writing to command...

ownCloud: s2.owncloud.com: SSL Session cookie without secure flag set

URL: https://s2.owncloud.com/ Issue detail The following cookie was issued by the application and does not have the secure flag set: sessionid=0fdc40cc016d1e70b1567b0071e5dcd2; expires=Sat Aug 22 03:45:12 2015; path=/; domain=s2.owncloud.com; max-age=86387; httponly The cookie appears to contain ...

OpenSSL SSLv2 Denial of Service Vulnerability

OpenSSL is an open source implementation of SSL used to enable strong encryption of network communications and is now widely used in a variety of web applications. A denial-of-service vulnerability exists in OpenSSL SSLv2, which can be exploited by a remote attacker via a constructed...

HP OpenView NNM getnnmdata.exe CGI Invalid ICount Remote Code Execution

No description provided by source. Exploit Title: HP OpenView NNM getnnmdata.exe CGI Invalid ICount Remote Code Execution Date: 2010.07.02 Author: S2 Crew Hungary Software Link: hp.com Version: 7.53 Tested on: Windows 2003 CVE: CVE-2010-1554 Code : !/usr/bin/python import struct import socket...

Motorola SURFBoard Cable Modem Directory Traversal

No description provided by source. Exploit Title: Motorola SURFBoard Cable Modem Directory Traversal Date: 2010.06.03 Author: S2 Crew Hungary Software Link: - Version: Model name: SBV6120E, Firmware Name: SBV6X2X-1.0.0.5-SCM-02-SHPC Tested on: ^ CVE: - Code : The following urls get back the...

gitWeb 1.5.2 - Remote Command Execution

No description provided by source. Exploit Title: gitWeb remote command execution Date: 2009.06.19 Author: S2 Crew Hungary Software Link: - Version: GIT 1.5.2 Tested on: debian linux, GIT 1.5.2 CVE: CVE-2008-5516 - CVE-2008-5517 Code: The cgi script doesn't show the command output blind command...

HP OpenView NNM getnnmdata.exe CGI Invalid Hostname Remote Code Execution

No description provided by source. Exploit Title: HP OpenView NNM getnnmdata.exe CGI Invalid Hostname Remote Code Execution Date: 2010.07.02 Author: S2 Crew Hungary Software Link: hp.com Version: 7.53 Tested on: Windows 2003 CVE: CVE-2010-1555 Code : !/usr/bin/python import struct import socket...

STRUTS2 S2-0 2 0 patch bypass vulnerability-vulnerability warning-the black bar safety net

0×0 0 background Security researchers noted that the Apache Struts2 vulnerability Bulletin S2-0 2 0, in process repair CVE-2 0 1 4-0 0 9 4 bug fixes program vulnerability exists, resulting patch is completely bypassed. 0×0 1 Analysis Struts2 S2-0 2 0 was added .\.|^ class\.. to filter action...

大汉版通JACT系统存在s2-020

简要描述： struts2补丁不及时。 详细说明： 大汉版通JACT系统使用的struts2存在s2-020漏洞，该漏洞在一定条件会为系统带来较大安全风险。例如当系统部署在Tomcat下时，class.classLoader.resources.dirContext.docBase可被任意赋值从而导致网站不可用或者文件下载等，如果Tomcat是运行在windows系统下则还可能造成远程代码执行。更多内容参考：http://drops.wooyun.org/papers/1377 PS:附送任意文件下载一枚：...

[ANN] Struts 2.3.16.2 GA release available - security fix

The Apache Struts group is pleased to announce that Struts 2.3.16.2 is available as a "General Availability" release.The GA designation is our highest quality grade. Apache Struts 2 is an elegant, extensible framework for creating enterprise-ready Java web applications. The framework is designed ...

Backdoor found in Samsung Galaxy Devices, allows Hackers to remotely access/modify Data

Google’s Android operating system may be open source, but the version of Android that runs on most phones, tablets, and other devices includes proprietary, closed-source components. Phone makers, including Samsung ships its Smartphones with a modified version of Android, with some pre-installed...

struts2 several recent vulnerability analysis&stable utilization payload-vulnerability warning-the black bar safety net

weibo:genxor 0x00 background See online on struts2 using the article very much, but for the vulnerability trigger the tracking analysis of the document is relatively small, nothing else to track it struts recent fights compared to fire two vulnerabilities, Research a bit to stabilize the use of t...

Apache Struts 安全措施绕过漏洞

BUGTRAQ ID: 62584 CVECAN ID: CVE-2013-4310 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。 Apache Struts 2.0.0-2.3.15.1的操作映射机制支持特殊参数前缀操作，这样有可能会在表格底部附加引导信息，在映射 "action:" 前缀操作时存在安全绕过漏洞，可被利用绕过某些安全限制，访问受限制功能。 0 Apache Group Struts 2.3.15.2 厂商补丁： Apache Group ------------ Apache...

struts2 latest vulnerability S2-0 1 6, S2-0 1 7 patch programme-vulnerability warning-the black bar safety net

Yesterday struts2 blast a good deal of vulnerability, with know Brother words to say is:“this afternoon the whole Chinese hacking ring like mad started to use this exploit black site, everyone can feel it.” See under the clouds the two days of data: ! Related reports: The disaster: the Chinese...

Struts2 latest remote code execution vulnerability S2-0 1 6 official patch analysis-vulnerability warning-the black bar safety net

Contrast a bit stucts svn, in fact, only modified one file ! For the action of the prefix, an increase cleanactionname function, filtering the ognl implementation, For the redirect and redirectaction prefix, the direct removal. !...

Apache Struts 多个开放重定向漏洞(CVE-2013-2248)

BUGTRAQ ID: 61196 CVECAN ID: CVE-2013-2248 Struts2 是第二代基于Model-View-Controller MVC模型的java企业级web应用框架。它是WebWork和Struts社区合并后的产物。 Apache Struts 2.0.0没有有效过滤"redirect:"/"redirectAction:"参数前缀内容，存在多个开放重定向漏洞，攻击者通过构建特制的URI并诱使用户点击，利用这些漏洞将这些用户重定向到攻击者控制的站点，执行钓鱼攻击。 0 Struts 2.3.15.1 厂商补丁： Apache Group...

Samsung Exynos芯片内核device /dev/exynos-mem本地权限提升漏洞

BUGTRAQ ID: 56955 Exynos是韩国三星电子基于ARM构架处理器品牌。 Samsung Exynos在内核设备/dev/exynos-mem内存在安全漏洞，此设备允许所有用户读写所有物理内存，导致攻击者获取系统的root访问权限。/dev/exynos-mem用于图形处理，例如照相机、图形内存分配、hdmi等。多个设备受到影响：Samsung Galaxy S2、Samsung Galxy Note 2、MEIZU MX、所有嵌入了exynos处理器（4210和4412）的设备。有3个库使用了/dev/exynos-mem：...