This Metasploit module exploits two separate remote command injection vulnerabilities in the Sophos Web Appliance versions 4.2.1.3 and below via the web administration interface. By sending a specially crafted request it's possible to inject system commands
7c4b3bbdbc3b0206bfe31759b404dcf843c219914e256a2ec58afefa528e061cSiklu Etherhaul versions prior to 7.4.0 suffer from an unauthenticated remote command execution vulnerability.
1488db4819cb3d631d5458d8303eb2a66ace7ffc1a16fa5a512858691028f7ceJava and Python both have URL handling code that can be leveraged for XML external entity (XXE) injection and SSRF attacks.
9f2a5aa311b233621706991238e47f4e31fc0b190ca89a1f42a16cfca5d09c4cUbuntu Security Notice 3210-1 - Ben Hayak discovered that it was possible to make LibreOffice Calc and Writer disclose arbitrary files to an attacker if a user opened a specially crafted file with embedded links.
eb76a721c6b299a108a59454abfea2068bb742c16cf457993916607f6caffb98Red Hat Security Advisory 2017-0309-01 - Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix: Quick emulator built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the Qemu process resulting in DoS or potentially execute arbitrary code on the host with privileges of Qemu process on the host.
b208a03f917075e83c83e02b7c9d9e67d01004db93202ffd0e4666086e2e5fbcRed Hat Security Advisory 2017-0307-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: When creating audit records for parameters to executed children processes, an attacker can convince the Linux kernel audit subsystem can create corrupt records which may allow an attacker to misrepresent or evade logging of executing commands. A flaw was found in the Linux kernel's implementation of the SCTP protocol. A remote attacker could trigger an out-of-bounds read with an offset of up to 64kB potentially causing the system to crash.
f5626e12bf318a6ceba6e16077d4ef1c50c6d37818aae8533ea4a67d5ff5c19aRed Hat Security Advisory 2017-0316-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol implementation freed SKB resources for a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system.
b636031802de3b3dfef681e9912cabfab34e12ce63c092ae7a18e3a97f900150Joomla JaJobBoard component version 1.5 suffers from a remote SQL injection vulnerability.
cfd28026a2c362b9c3e90599bf6cb5ce173e37fdc75ad2d90aa1c2e8ec890d0aSynologic NAS suffers from an IP blocking bypass vulnerability.
c05fd9b53966972f034228ae1c6b8442f84c27015716fc54eb3e8028bd12c158Joomla Redshop component versions 1.4 and 1.5 suffer from a remote SQL injection vulnerability.
7bce940bba1c54337da78e867025227f7e701372484e0d4567c3ea084407f9f1
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed