all versions of Documentum Content Server contain dm_bp_transition docbase method which is written on basic, implementation of this docbase methods does not properly validate user input which allows attacker to execute arbitrary code with superuser privileges.
HPE OpenCall Media Platform (OCMP) is a suite of software and hardware applications which allow implementation of common telecom operator services such as voicemail, sms (short message service), prepaid, billing, hlr, etc. It implements industry standard telecom protocols and standards such as SS7, ISUP, TCAP, SIP, MRCP, RTSP, and VoiceXML. There are 3 different components that are vulnerable in HPE OpenCall Media Platform (OCMP), and for each component has the following vulnerabilities: Application Content Manager: Reflected Cross-Site Scripting (XSS) – /mcm/resources/ Platform Administration Tool: Reflected Cross-Site Scripting (XSS) that lead to Remote Code Execution, Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_TYPE0 parameter, Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_TYPE1 parameter, Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_TYPE2 parameter, Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_TYPE3 parameter, Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NAME0 parameter, Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NAME1 parameter, Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NAME2 parameter, Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NAME3 parameter, Remote File Inclusion (RFI) – /mcm/resources/
The code comprises an SQL statement containing strings that can be altered by an attacker. The manipulated SQL statement can be used then to retrieve additional data from the database or to modify the data without authorization.
An attacker can use an XML external entity vulnerability to send specially crafted unauthorized XML requests, which will be processed by the XML parser. The attacker can use an XML external entity vulnerability for getting unauthorised access to the OS file system.
The vulnerability is found in LightDM, which is the Ubuntu’s default desktop manager, more specifically in the guest login feature. By default LightDM allows you to log into a session as a temporary user. This is implemented in a script called ‘guest-account’.
An unescaped parameter was found in Wow Forms v2.1 (WP plugin). An attacker can exploit this vulnerability to read from the database. The POST parameter 'wowformid' is vulnerable.
An unescaped parameter was found in Wow Viral Signups v2.1 (WP plugin). An attacker can exploit this vulnerability to read from the database. The POST parameter 'idsignup' is vulnerable.
An unescaped parameter was found in Car Rental System v2.5 (WP plugin). An attacker can exploit this vulnerability to read from the database. The POST parameters 'pickuploc', 'dropoffloc', and 'car_type' are vulnerable.
An unescaped parameter was found in KittyCatfish version 2.2 (WP plugin). An attacker can exploit this vulnerability to read from the database. The get oarameter 'kc_ad' is vulnerable. An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.
DCCService.exe is running on autostart as System. This service has auto update functionality. Basically it periodically checks https://otbs.azurewebsites.net looking for new config file. Under normal conditions we cannot spoof this connection because it’s SSL. But here WebUtils.sendWebRequest() is executed using Impersonator.RunImpersonated(). RunImpersonated() executes given function in the context of currently logged in user. In Windows system we can add any certificate to Local user root store. Then this certificate is considered as trusted so we can perform MITM attack. It can be done using simple proxy server because by default .NET HttpWebRequest() uses IE proxy settings (which can by set by any user without administrator priveleges).
Services By CQR