Halliburton LogView Pro 10.0.1 is vulnerable to a local buffer overflow vulnerability. By creating a specially crafted .tif file, an attacker can cause a denial of service condition. The vendor has been contacted but no reply.
Dive Assistant - Desktop Edition comes with a template builder .exe to create print templates. The templates are saved and uploaded as XML files which are vulnerable to XXE injection. Sending a crafted payload to a user, when opened in Dive Assistant - Template Builder, will return the content of any local files to a remote attacker.
This post describes an exploitable vulnerability (CVE-2016-2384 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2384) in the usb-midi Linux kernel driver. The vulnerability is present only if the usb-midi module is enabled, but as far as I can see many modern distributions do this. The bug has been fixed upstream (https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07d86ca93db7e5cdf4743564d98292042ec21af7). The vulnerability can be exploited in two ways: Denial of service (requires physical access) and Arbitrary code execution with ring 0 privileges (requires both physical and local access). A proof-of-concept exploit (poc.c - https://github.com/xairy/kernel-exploits/blob/master/CVE-2016-2384/poc.c, poc.py - https://github.com/xairy/kernel-exploits/blob/master/CVE-2016-2384/poc.py) is provided for both types of attacks. The provided exploit uses a Facedancer2 device (https://github.com/mame82/Facedancer2) as a malicious USB device.
Any user who can login into the router can exploit the Local File Inclusion reading files stored inside the device. Login into the router and use the path of a file you want to read as getpage parameter.
POST /cmsms/admin/editusertag.php?_sk_=2a7da2216d41e0ac&userplugin_id=4 HTTP/1.1 _sk_=2a7da2216d41e0ac&userplugin_id=4&userplugin_name=aaa&code=passthru('dir')%3B&description=&run=1&apply=1&ajax=1 POST /cmsms/admin/addgroup.php HTTP/1.1 _sk_=92a32a8aaa87e958&group=%3Csvg%2Fonload%3Dalert%282%29%3E&description=%22%3E%3Csvg%2Fonload%3Dalert%283%29%3E&active=on&addgroup=true
This exploit is a local privilege escalation exploit for CVE-2016-9793. It is used to gain root access on affected kernels from 3.11 to 4.8. It has been tested in QEMU only. It does not include any KASLR, SMEP or SMAP bypass. The exploit uses a thread to overwrite the sock->sk_sndbuf with a payload that calls get_root() which in turn calls commit_creds() and prepare_kernel_cred() to gain root access.
OpenVPN is vulnerable to a denial of service attack when a malicious client sends a crafted packet with an invalid session ID. This causes the server to crash and the TUN/TAP interface to be closed. The vulnerability affects OpenVPN versions prior to 2.4.0.
gongwalker API Manager v1.1 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious HTML page that when visited by an authenticated user, can add, delete or edit API data. This can be done by sending a POST request to the vulnerable URL with the required parameters. The vulnerable parameters are 'num', 'p[name][]', 'p[paramType][]', 'memo', 'p[des][]', 'type', 'url', 'p[type][]', 'p[default][]', 'des', 're', 'name' and 'id'. An attacker can use this vulnerability to add, delete or edit API data without the user's knowledge.
Code executed via the updatesetting action will modify 'setting.php'. In the process, there is not verification of the input value, so it is possible to insert php code. Vulnerable parameters include footer, buttons_before, buttons_after, banextra, and muteextra. Attack code is a POST request with the payload 'aaaaaa';$hacker=hwul//inject_php_code';
A proof-of-concept local root exploit for CVE-2017-7308. Includes a SMEP & SMAP bypass. Tested on 4.8.0-41-generic Ubuntu kernel.
Services By CQR