Multiple path traversals on Windows hosts

Description validatepathissafe function in file /mlflow/server/handlers.py, introduced in PR 7891 on Feb 24th, 2023 does not account for Windows absolute path format, and thus can be bypassed on MLFlow servers, running on Windows hosts, exposing them to a number of high-impact directory traversal...

[SECURITY] Fedora 38 Update: amanda-3.5.3-1.fc38

AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to one or more tape drives or disk files. AMANDA uses native dump and/or GNU tar facilities and can back up a...

Siemens JT2Go < 14.1.0.5 Multiple Vulnerabilities (SSA-360681)

The version of Siemens JT2Go installed on the remote Windows hosts is prior to 14.1.0.5. It is, therefore, affected by multiple vulnerabilities in the APDFL library that could be triggered when the application reads malicious PDF files. If a user is tricked to open a malicious PDF file this could...

Siemens JT2Go < 14.1.0.4 Multiple Vulnerabilities (SSA-120378)

The version of Siemens JT2Go installed on the remote Windows hosts is prior to 14.1.0.4. It is, therefore, affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious TIF, CGM or PDF files. If a user is tricked to open a malicious TIF, CGM or PDF...

BlueSky ransomware incorporates Multithreading to expedite encryption

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary BlueSky ransomware is actively targeting businesses and demanding a ransom. It appears that they have ties with the Conti ransomware group. The malware is now primarily targeting Windows hosts and uses...

All-in-One WP Migration < 7.59 - Admin+ File Deletion on Windows Hosts via Path Traversal

The plugin is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the /lib/model/class-ai1wm-backups.php file which can be exploited by administrative users, and users who have access to the site’s secret key on WordPress instances with Windows...

WordPress All in One WP Migration plugin <= 7.58 - Directory Traversal to File Deletion on Windows Hosts vulnerability

Directory Traversal to File Deletion on Windows Hosts vulnerability discovered by haidv35 Viettel Cyber Security in WordPress All-in-One WP Migration plugin versions = 7.58. Solution Update the WordPress All-in-One WP Migration plugin to the latest available version at least 7.59...

Baby Golang-Based Botnet Already Pulling in $3K/Month for Operators

There’s a new, still-under-development, Golang-based botnet called Kraken with a level of brawn that belies its youth: It’s using the SmokeLoader malware loader to spread like wildfire and is already raking in a tidy USD $3,000/month for its operators, researchers report. Though its name may soun...

Metasploit Wrap-Up

Welcome, Little Hippo: PetitPotam Our very own @zeroSteiner ported the PetitPotam exploit to Metasploit this week. This module leverages CVE-2021-36942, a vulnerability in the Windows Encrypting File System EFS API, to capture machine NTLM hashes. This uses the EfsRpcOpenFileRaw function of the...

Microsoft Active Directory Certificate Services NTLM Relay (CVE-2021-36942; CVE-2022-26925)

An NTLM relay vulnerability exists in Microsoft Active Directory Certificate Services. A remote attack can coerce Windows hosts to authenticate to other machines via the MS-EFSRPC protocol and obtain its NTLM credential. Successful exploitation could lead to complete takeover of the target domain...

Adobe Illustrator < 25.3.0 Multiple Vulnerabilities (APSB21-42)

The version of Adobe Illustrator installed on the remote Windows host is prior to 25.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-42 advisory. - Adobe Illustrator version 25.2.3 and earlier is affected by a potential Command injection vulnerability when...

Siemens JT2Go < 13.2 Multiple Vulnerabilities (SSA-483182)

The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.2. It is, therefore, affected by multiple vulnerabilities, including the following: - The Gifloader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This cou...

Siemens JT2Go < 13.1.0.3 Code Execution (SSA-645530)

The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0.3. It is, therefore, affected by a code execution vulnerability. The TIFFloader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an...

RCE affecting Windows hosts via UNC paths to translation files

This is a security release. SECURITY Fixes CVE-2021-34551, a complex RCE affecting Windows hosts. See SECURITY.md for details. The fix for this issue changes the way that language files are loaded. While they remain in the same PHP-like format, they are processed as plain text, and any code in th...

Siemens JT2Go < 13.1.0.1 Multiple Vulnerabilities (SSA-663999)

The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0.1. It is, therefore, affected by multiple vulnerabilities, including the following: - A vulnerability has been identified in JT2Go. Affected applications lack proper validation of user-supplied data when parsing...

Siemens JT2Go < 13.1.0 Multiple Vulnerabilities (SSA-622830)

The version of Siemens JT2Go installed on the remote Windows hosts is prior to 13.1.0. It is, therefore, affected by multiple vulnerabilities, including the following: - A vulnerability has been identified in JT2Go All versions V13.1.0, Teamcenter Visualization All versions V13.1.0. Affected...

Agent Tesla Panel Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Agent Tesla Panel Remote Code Execution', 'Description' = %q This module exploits a command injection vulnerability within the Agent Tesla contro...

TrickBot Evolves to Go After SSH Keys

The TrickBot info-stealing malware has updated its password grabber to target data from OpenSSH and OpenVPN applications. OpenSSH is a connectivity tool for remote login with the SSH protocol; it encrypts all traffic to eliminate eavesdropping. OpenVPN meanwhile is used for secure private...

Why Asset Management is so important for Vulnerability Management and Infrastructure Security?

When people ask me how should they start building Vulnerability Management process in their organization well, sometimes it happens, I advice them to create an effective Asset Management process first. Because it's the foundation of the whole Infrastructure Security. The term "Asset Management" h...

Microsoft Office: Disable Opt-in Wizard on first run

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officeoptinwizard.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Disable Opt-in Wizard on first run Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...