Security Bulletin: There are multiple security vulnerabilities in Apache Storm used by IBM Tivoli Netcool Manager.

Summary Apache-storm, used by IBM Tivoli Network Manager, contains many internal libraries which are vulnerable to various types of CVEs. Revealing sensitive information CVE-2021-28169, bypassing ACL validations CVE-2018-17196, heap based buffer overflow CVE-2015-5237, denial of service...

Client-Side JavaScript Prototype Pollution in oro/platform

Summary By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. Workarounds Configure WAF to dro...

Freddy - Automatically Identify Deserialisation Issues In Java And .NET Applications By Using Active And Passive Scans

A Burp Suite extension to aid in detecting and exploiting serialisation libraries/APIs. This useful extension was originally developed by Nick Bloor @nickstadb for NCC Group and is mainly based on the work of Alvaro Muñoz and Oleksandr Mirosh, Friday the 13th: JSON Attacks, which they presented a...

Searching statically-linked vulnerable library functions in executable code

Helping researchers find 0ld days Posted by Thomas Dullien, Project Zero Executive summary Software supply chains are increasingly complicated, and it can be hard to detect statically-linked copies of vulnerable third-party libraries in executables. This blog post discusses the technical details ...

Jenkins Multiple Vulnerabilities (Oct 2017) - Linux

Jenkins is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:jenkins:jenkins"; ifdescription...

ArcGIS Server 10.3.1 RMIClassLoader useCodebaseOnly=false Code Execution Exploit

ArcGIS Server version 10.3.1 suffers from an RMIClassLoader useCodebaseOnly=false remote code execution vulnerability. Using an Esri-provided image on Azure's Marketplace, ArcGIS Server 10.3.1 started Java's rmid on port 1098 and explicitly set the property java.rmi.server.useCodebaseOnly equal t...

Play TV v1.25.1(Build r123776) - DLL Hijack Vulnerability

Document Title: =============== Play TV v1.25.1Build r123776 - DLL Hijack Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2085 Release Date: ============= 2017-09-04 Vulnerability Laboratory ID VL-ID: ====================================...

Play TV v1.25.1(Build r123776) - DLL Hijack Vulnerability

Document Title: =============== Play TV v1.25.1Build r123776 - DLL Hijack Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2085 Release Date: ============= 2017-09-03 Vulnerability Laboratory ID VL-ID: ====================================...

OpenText Documentum D2 - Remote Code Execution Exploit

Exploit for java platform in category remote exploits / CVE Identifier: CVE-2017-5586 Vendor: OpenText Affected products: Documentum D2 version 4.x Researcher: Andrey B. Panfilov Severity Rating: CVSS v3 Base Score: 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Description: Document D2 contains...

OpenText Documentum D2 - Remote Code Execution

OpenText Documentum D2 - Remote Code Execution / CVE Identifier: CVE-2017-5586 Vendor: OpenText Affected products: Documentum D2 version 4.x Researcher: Andrey B. Panfilov Severity Rating: CVSS v3 Base Score: 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Description: Document D2 contains vulnerable...

Aura Video Converter 1.6.3 - DLL Hijacking Exploit

Document Title: =============== Aura Video Converter 1.6.3 - DLL Hijacking Exploit References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1965 Release Date: ============= 2016-10-04 Vulnerability Laboratory ID VL-ID: ==================================== 1965...

iPod Video Converter v1.34 - DLL Hijacking Exploit

Document Title: =============== iPod Video Converter v1.34 - DLL Hijacking Exploit References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1961 Release Date: ============= 2016-09-29 Vulnerability Laboratory ID VL-ID: ==================================== 1961...

iPod Video Converter v1.34 - DLL Hijacking Exploit

Document Title: =============== iPod Video Converter v1.34 - DLL Hijacking Exploit References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1961 Release Date: ============= 2016-09-28 Vulnerability Laboratory ID VL-ID: ==================================== 1961...

Wise-FTP 8.0.2 DLL Hijack

Technical Details & Description: ================================ A local dll injection vulnerability has been discovered in the official Wise-FTP v8.0.2 software. The issue allows local attackers to inject code to vulnerable libraries to compromise the process or to gain higher access privileges...

SCO Open Server 5.0.5 IRIX 6.2 ibX11X11 ToolkitAthena Widget Library - Local Buffer Overflow

SCO Open Server 5.0.5 IRIX 6.2 ibX11X11 ToolkitAthena Widget Library - Local Buffer Overflow // source: https://www.securityfocus.com/bid/884/info SCO Openserver and SGI IRIX 6.2 confirmed, possibly others are vulnerable to several buffer overflows in various shared libraries related to the X...