A vulnerability in Simple File Uploader allows an attacker to download arbitrary files from the server. This is due to the lack of proper input validation and authentication checks in the application. An attacker can craft a malicious URL to download any file from the server.
This module takes advantage of custom hg-ssh wrapper implementations that don't adequately validate parameters passed to the hg binary, allowing users to trigger a Python Debugger session, which allows arbitrary Python code execution.
A vulnerability has been discovered in Revive Ad Server, which can be exploited by malicious people to conduct cross-site scripting attacks. When you create a banner using Generic HTML Banner, input passed via the 'htmltemplate' parameter to '/banner-edit.php' is not properly sanitised before being returned to the user (This is probably expected as it's an html banner). But, this can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. This XSS vector allow to execute scripts to gather the CSRF token and submit a form to update user rights.
October CMS build 412 contains several vulnerabilities. Some of them allow an attacker to execute PHP code on the server. Following issues have been identified: 1. PHP upload protection bypass 2. Apache .htaccess upload 3. stored WCI in image name 4. reflected WCI while displaying project ID 5. PHP code execution via asset management 6. delete file via PHP object injection 7. asset save path modification
This module exploits a command injection vulnerability in an undocumented CGI file in several versions of the WePresent WiPG-1000 devices. Version 2.0.0.7 was confirmed vulnerable, 2.2.3.0 patched this vulnerability.
This module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how a olelink object can make a http(s) request, and execute hta code in response. This bug was originally seen being exploited in the wild starting in Oct 2016. This module was created by reversing a public malware sample.
The DAX2API service installed as part of the Realtek Audio Driver on Windows 10 is vulnerable to a privilege escalation vulnerability which allows a normal user to get arbitrary system privileges. The use of .NET for DCOM is inherently unsafe and should not be used. There’s public exploit code to elevate privileges on arbitrary services available at https://github.com/tyranid/ExploitDotNetDCOM. Microsoft recommends moving from using DCOM to WCF for .NET services of different privilege levels.
We have discovered a heap double-free vulnerability in the latest version of VirtualBox (5.1.18), with Guest Additions (and more specifically shared folders) enabled in the guest operating system. The heap memory corruption takes place in the VirtualBox.exe process running on a Windows host (other host platforms were untested). It can be triggered from an unprivileged ring-3 process running in a Windows guest, by performing two nt!NtQueryDirectoryFile system calls against a shared (sub)directory one after another: the first one with the ReturnSingleEntry argument set to FALSE, and the next one with ReturnSingleEntry=TRUE. During the second system call, a double free takes place and the VM execution is aborted. We have confirmed that the vulnerability reproduces with Windows 7/10 32-bit as the guest, and Windows 7 64-bit as the host system, but haven’t checked other configurations.
In builtins/ArrayPrototype.js, the function concatSlowPath calls a native method @appendMemcpy with a parameter resultIndex that is handled unsafely by the method. It calls JSArray::appendMemcpy, which calculates the memory size for the combined arrays as follows: unsigned newLength = startIndex + otherLength. If startIndex (resultIndex from concatSlowPath in JS) is very large, an integer overflow can occur, causing too small a buffer to be allocated, and copying to occur outside of the buffer. A minimal PoC is as follows, and a full PoC is attached.
The pid parameter of the Joomla Component Myportfolio 3.0.2 is vulnerable to SQL Injection. An attacker can exploit this vulnerability by sending a malicious SQL query to the vulnerable parameter. This can allow the attacker to gain access to sensitive information from the database.
Services By CQR