This module exploits a path traversal vulnerability in the 'linuxpkgs' action of 'agent' controller of the Red Hat CloudForms Management Engine 5.1 (ManageIQ Enterprise Virtualization Manager 5.0 and earlier). It uploads a fake controller to the controllers directory of the Rails application with the encoded payload as an action and sends a request to this action to execute the payload. Optionally, it can also upload a routing file containing a route to the action. (Which is not necessary, since the application already contains a general default route.)
RealNetworks RealPlayer is prone to a buffer overflow vulnerability when handling a specially crafted .rmp file. An attacker can exploit this vulnerability to execute arbitrary code in the context of the application. Successful exploitation requires the user to open the malicious file via the application's menu or by clicking on it. This vulnerability affects RealNetworks RealPlayer versions 16.0.3.51 and 16.0.2.32.
The vulnerable file is located at http://vulnerable-site.com/wp-content/themes/persuasion/lib/scripts/dl-skin.php. In exploit code, file name in first text box should be readable on the vulnerable server, then the vulnerable code allows it to be downloaded from the server. And the second textbox accepts a directory path. If it is writeable then vulnerable code will delete its contents. An attacker can download readable files from the server and also can delete contents of writeable directories.
Easy Karaokay Player 3.3.31 is vulnerable to an Integer Division by Zero vulnerability. This vulnerability is caused due to a boundary error when handling .wav files. This can be exploited to cause a denial of service or potentially allow remote code execution by tricking a user into opening a specially crafted .wav file.
The default installation and configuration of Jenkins SonarQube Plugin in Jenkins CI is prone to a security vulnerability. This vulnerability could be exploited by a remote attacker (a jenkins malicious user with Manage Jenkins enabled) to obtain the SonarQube's credentials.
The default installation and configuration of Jenkins CI is prone to a security vulnerability. The Jenkins CI default markup formatter permits offsite-bound forms. This vulnerability could be exploited by a remote attacker (a malicious user) to inject malicious persistent HTML script code (application side). To reproduce the vulnerability, the attacker (a malicious user) can add the malicious HTML script code in the 'Descriotion' input field and click on save button. The code execution happens when the victim (an unaware user) view the 'People List' and click on attacker user id.
The vulnerability exists due to insufficient filtration of 'orderby' HTTP POST parameter passed to '/catalog/[id]' URL. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database. Simple exploit code below uses blind SQL injection exploitation technique, and will display different order of records on the page if MySQL version is 5.*: <form action='http://[host]/catalog/2' method='post' name='main'><input type='hidden' name='orderby' value='(-pubdate*(substring(version(),1,1)=5))'><input type='hidden' name='orderto' value='asc'><input type='submit' id='btn'></form>
Several input fields of the web application are vulnerable to OS command injection. E.g. the application allows the setting of parameters like 'sector size' or 'skip count' for a forensic imaging task. Because of improper neutralization in combination with the web server running with root privileges, an attacker is able to access and manipulate the complete system. The web application is vulnerable to Cross-Site Scripting (XSS). E.g. the application allows the setting of parameters like 'sector size' or 'skip count' for a forensic imaging task. Because of improper neutralization, an attacker is able to inject malicious content into the web application.
The PHP function opessl_x509_parse() is used to parse x509 certificates. It is used by many PHP applications to verify the authenticity of certificates. The problem is that the helper function asn1_time_to_time_t() which is used to convert timestamps from ASN1 string format into integer timestamp values is not binary safe. It can be tricked to write up to five NUL bytes outside of an allocated buffer.
Multiple persistent input validation web vulnerabilities have been discovered in the Shenzhen Youmi Information Technology Co. Ltd - FileMaster v3.1 iOS mobile web-application. The vulnerabilities are located in the `name` and `password` value of the `login` module. Remote attackers are able to inject own malicious script codes to the application-side of the vulnerable module. The request method to inject is POST and the attack vector is located on the application-side. The injection point is the `name` and `password` value of the `login` module. The execution point is the application-side of the vulnerable service.
Services By CQR