Depth Security discovered a vulnerability in the Infoblox Network Automation management web interface. This attack does not require authentication of any kind. The vulnerability exists due to insufficient sanitization of user-supplied data in in skipjackUsername POST parameter. A remote attacker can inject operating system commands as the root user, and completely compromise the operating system.
OpenVAS Manager 4.0 is vulnerable to an authentication bypass vulnerability. An attacker can exploit this vulnerability to gain access to the OpenVAS Manager without authentication. This vulnerability is due to the lack of authentication checks for certain commands. An attacker can send a specially crafted request to the OpenVAS Manager to bypass authentication and gain access to the system.
C99.php shells are backdoored. To bypass authentication, the attacker can add '?c99shcook[login]=0' to the URL. This bypasses the authentication by extracting the $_REQUEST['c99shcook'] variable.
MSHTML!CInput::DoClick contains a use-after-free vulnerability. When the DoClick function is called, the CFormElement object is freed, but the pointer is still used to write to memory. This can lead to memory corruption and potentially arbitrary code execution.
A local file include web vulnerability has been discovered in the official WonderApplications Photo Org v8.3 iOS web-application. The vulnerability allows local attackers to inject own malicious script codes to application-side of the vulnerable module. The vulnerability is located in the `index.php` file of the `/photoorg/` directory. Local attackers are able to inject own malicious script codes to the vulnerable `index.php` file.
The Wordpress plugin 'MailPoet Newsletters' (wysija-newsletters) before 2.6.8 is vulnerable to an unauthenticated file upload. The exploit uses the Upload Theme functionality to upload a zip file containing the payload. The plugin used the admin_init hook, which is also executed for unauthenticated users when accessing a specific URL. The developers tried to fix the vulnerablility in version 2.6.7 but the fix can be bypassed. In PHPs default configuration, a POST variable overwrites a GET variable in the $_REQUEST array. The plugin uses $_REQUEST to check for access rights. By setting the POST parameter to something not beginning with 'wysija_', the check is bypassed. Wordpress uses the $_GET array to determine the page and is so not affected by this.
This module exploits an unauthenticated remote command execution vulnerability in version 0.4.0 of Gitlist. The problem exists in the handling of an specially crafted file name when trying to blame it.
This module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing 11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be abused to upload a malicious file onto an arbitrary location due to a directory traversal flaw, and compromise the server. By default Oracle Event Processing uses a Jetty Application Server without JSP support, which limits the attack to WbemExec. The current WbemExec technique only requires arbitrary write to the file system, but at the moment the module only supports Windows 2003 SP2 or older.
This module exploits a vulnerability in the password recovery feature of certain Netgear WNR1000v3 routers. Affected devices will allow retrieval of the plaintext administrator credentials.
There is a possibility to upload arbitrary file in Frog CMS latest version 0.9.5. The vulnerability exist because of the filemanager plugin is not properly verifying the extension of uploaded files. Go to http://localhost/frog_095/admin/?/plugin/file_manager/images and upload an executable php file. Go to http://localhost/Frog/frog_095/public/images/ for verification.
Services By CQR