Jenkins Remote Code Execution

In the exploitation, the target is always escalating the read primitive or write primitive to code execution! From the previous section, we can write malicious JAR file into remote Jenkins server by Grape. However, the next problem is how to execute code? By diving into Grape implementation on...

Jenkins Plugin Script Security 1.50Declarative 1.3.4.1Groovy 2.61.1 - Remote Code Execution (PoC)

Jenkins Plugin Script Security 1.50Declarative 1.3.4.1Groovy 2.61.1 - Remote Code Execution PoC In the exploitation, the target is always escalating the read primitive or write primitive to code execution! From the previous section, we can write malicious JAR file into remote Jenkins server by...

Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)

In the exploitation, the target is always escalating the read primitive or write primitive to code execution! From the previous section, we can write malicious JAR file into remote Jenkins server by Grape. However, the next problem is how to execute code? By diving into Grape implementation on...

CVE-2019-8389

A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder with a crafted ../ payload...

GNU Libextractor ZIP File Comment Out-of-Bounds Read (CVE-2018-16430)

An out-of-bounds read vulnerability exists in Libextractor. The vulnerability is due to improper handling of long File Comment fields within ZIP files. Successful exploitation of this vulnerability could lead to denial-of-service conditions or disclosure of sensitive information...

CVE-2019-8362

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...

CVE-2019-8362

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...

Input validation

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...

TAU Threat Intelligence Notification: New macOS Malware Variant of Shlayer (OSX) Discovered

Carbon Black’s Threat Analysis Unit TAU recently discovered a new variant of a family of macOS malware which was first discovered in February of 2018 by researchers from Intego. TAU has obtained new samples of this malware and observed downloads of the malware from multiple sites, primarily...

GHSA-W5M8-5V9M-XHX5 Critical severity vulnerability that affects Haraka

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection...

Critical severity vulnerability that affects Haraka

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection...

TAU Threat Intelligence Notification: Java Embedded MSI Files

Summary Application whitelisting provides environments with access controls to stop unauthorized software from executing. This is accomplished by utilizing file and folder attributes including but not limited to file path, filename, digital signature, publisher, cryptographic hash and product nam...

USN-3884-1 libarchive vulnerabilities

It was discovered that libarchive incorrectly handled certain 7zip files. An attacker could possibly use this issue to cause a denial of service. CVE-2019-1000019, CVE-2019-1000020...

Command injection

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection...

CVE-2016-1000282

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection...

CVE-2016-1000282

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection...

CVE-2016-1000282

Haraka is affected: versions 2.8.8 and earlier include an attachment zip-processing plugin that enables a remote command-injection vulnerability (CVE-2016-1000282). Exploitation leads to remote code execution with high impact; PoC/exploits reference Haraka

CVE-2016-1000282

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection...

DEBIAN-CVE-2019-1000019

libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards release v3.0.2 onwards contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archivereadsupportformat7zip.c, headerbytes that can result in a crash denial of service. This attack appears to be...

idreamsoft iCMS Directory Traversal Vulnerability (CNVD-2019-12123)

iCMS is an efficient and simple content management system built with PHP and MySQL. A directory traversal vulnerability exists in admincp.php?app=apps&do=save in idreamsoft iCMS 7.0.13, which can be exploited by an attacker to create a ZIP file with the contents of an arbitrary directory and...