XiongMai uc-http 1.0.0 Local File Inclusion / Directory Traversal

uc-httpd is an HTTP daemon used by a wide array of IoT devices and is vulnerable to local file inclusion and directory traversal bugs. +---------------------------------------------------------+ | Vulnerable Software: uc-httpd | | Vendor: XiongMai Technologies | | Vulnerability Type: LFI, Directo...

xenstore denial of service via repeated update

ISSUE DESCRIPTION xenstored supports transactions, such that if writes which would invalidate assumptions of a transaction occur, the entire transaction fails. Typical response on a failed transaction is to simply retry the transaction until it succeeds. Unprivileged domains may issue writes to...

cirrus_bitblt_cputovideo does not check if memory region is safe

ISSUE DESCRIPTION In CIRRUSBLTMODEMEMSYSSRC mode the bitblit copy routine cirrusbitbltcputovideo fails to check wethehr the specified memory region is safe. IMPACT A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation. VULNERABL...

Adobe Flash Player Heap Buffer Overflow Vulnerability (CNVD-2017-00370)

Adobe Flash Player is a proprietary multimedia program developed by Adobe, Incorporated, and is widely used. A heap buffer overflow vulnerability exists in Adobe Flash Player, which can be exploited by an attacker to compromise a vulnerable system and cause arbitrary code execution...

Adobe Flash Player Heap Buffer Overflow Vulnerability (CNVD-2017-00371)

Adobe Flash Player is a proprietary multimedia program developed by Adobe, Incorporated, and is widely used. A heap buffer overflow vulnerability exists in Adobe Flash Player, which can be exploited by an attacker to compromise a vulnerable system and cause arbitrary code execution...

Inteno EG101R1 VoIP Router - Unauthenticated DNS Change

Exploit for cgi platform in category web applications !/bin/bash Inteno EG101R1 VoIP Router Unauthenticated Remote DNS Change Exploit Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Description: The vulnerability exist in the web interface,...

ipmi-cipher-zero NSE Script

IPMI 2.0 Cipher Zero Authentication Bypass Scanner. This module identifies IPMI 2.0 compatible systems that are vulnerable to an authentication bypass vulnerability through the use of cipher zero. Script Arguments vulns.short, vulns.showall See the documentation for the vulns library. Example Usa...

Trains, Planes, Autos Increasingly in Cybercriminal's Bullseye

The transportation industry is increasingly being targeted by cyber criminals who see the sprawling multi-billion dollar industry as ripe for financially motivated attacks. According to IBM’s X-Force security team, the systems behind planes, trains and automobiles have now become bigger paydays f...

Increased Risks from Macro-Based Malware

Microsoft Office applications use macros to automate routine tasks. However, macros can contain malicious code that can be used to exploit vulnerable systems. Recently, there has been a resurgence of malware that is spread via macros. Individuals and organizations should proactively secure system...

Unsanitised driver domain input in libxl device handling

ISSUE DESCRIPTION libxl's device-handling code freely uses and trusts information from the backend directories in xenstore. The backend domain driver domain can store bogus data in the backend, causing libxl's enquiry functions to fail, confusing management tools. A driver domain can also remove...

QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks

ISSUE DESCRIPTION Qemu VGA module allows banked access to video memory using the window at 0xa00000 and it supports different access modes with different address calculations. But an attacker can easily change access modes after setting the bank register. This is CVE-2016-3710. Qemu VGA module...

hugetlbfs use may crash PV Linux guests

ISSUE DESCRIPTION Huge 2Mb pages are generally unavailable to PV guests. Since x86 Linux pvops-based kernels are generally multi purpose, they would normally be built with hugetlbfs support enabled. Use of that functionality by an application in a PV guest would cause an infinite page fault loop,...

I/O port access privilege escalation in x86-64 Linux

ISSUE DESCRIPTION IRET and POPF do not modify EFLAGS.IOPL when executed by code at a privilege level other than zero. Since PV Xen guests run at privilege level 3 for 64-bit ones; 32-bit ones run at privilege level 1, to compensate for this the context switching of EFLAGS.IOPL requires the guest ...

Microsoft Windows CVE-2016-0009 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition. Technologies Affected Microsoft...

paravirtualized drivers incautious about shared memory contents

ISSUE DESCRIPTION The compiler can emit optimizations in the PV backend drivers which can lead to double fetch vulnerabilities. Specifically the shared memory between the frontend and backend can be fetched twice during which time the frontend can alter the contents possibly leading to arbitrary...

arm: various unimplemented hypercalls log without rate limiting

ISSUE DESCRIPTION The HYPERVISORphysdevop hypercall and most suboperations of the HYPERVISORhvmop hypercall are not currently implemented by Xen on ARM and when called will log the use to the hypervisor console. However these guest accessible log messages are not rate-limited. IMPACT A malicious...

xl command line config handling stack overflow

ISSUE DESCRIPTION The xl command line utility mishandles long configuration values when passed as command line arguments, with a buffer overrun. VULNERABLE SYSTEMS Systems built on top of xl which pass laundered or checked but otherwise untrusted configuration values onto xl's command line, witho...

某政府在用系统通用型SQL注入#3

简要描述： rt 详细说明： 某政府在用系统通用型SQL注入3。 案例如下: http://wssp.jiangxi.gov.cn:8008/outportal/licenseManage/licenseManage.jsp http://117.40.187.175:8008/outportal/licenseManage/licenseManage.jsp http://xzfw.jinxi.gov.cn/outportal/licenseManage/licenseManage.jsp...

Interactive Data eSignal Listener Buffer Overflow - Ver2 (CVE-2004-1868)

eSignal is a real-time market data and support tool provided by Interactive Data Corporation. The product supplies financial market data and more for traders over the internet. To facilitate the receipt of incoming data, eSignal opens a local, listening socket on TCP Port 80. There exists a buffe...

KLA10510 Multiple vulnerabilities in Cisco IOS

An unspecified vulnerabilities were found in multiple versions of Cisco IOS. By exploiting these vulnerabilities malicious users can cause denial of service or execute arbitrary code. This vulnerability can be exploited remotely via a specially designed packets or messages. Original advisories -...