An SQL injection vulnerability exists in the Booking Calendar WordPress plugin. This vulnerability allows an attacker to view data from the database. The affected parameter is not properly sanitized or protected with an anti-Cross-Site Request Forgery token. Consequently, it can (also be exploited by luring the target user into clicking a specially crafted link or visiting a malicious website (or advertisement).
In JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h, the function genericTypedArrayViewProtoFuncCopyWithin contains the code that calls valueOf on a parameter to the copyWithin function, which can contain a function that neuters the this array, causing the variable 'array' to be null. However, the 'to' and 'from' variables can be very large values, up to 0x7fffffff, which could be valid pointers on ARM and 32-bit platforms. This allows an absolute pointer in this range to be written to.
In JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h, the function genericTypedArrayViewProtoFuncFill contains the following code: argumentClampedIndexFromStartOrEnd will call valueOf on a parameter to the fill function, which can contain a function that neuters the this array, causing the pointer used by setRangeToValue to be null. However, the begin and end variables can be very large values, up to 0x7fffffff, which could be valid pointers on ARM and 32-bit platforms. This allows an absolute pointer in this range to be written to.
perf_event_open() offers to collect various pieces of information when an event occurs, including a user stack backtrace (PERF_SAMPLE_CALLCHAIN). To collect a user stack backtrace, the kernel grabs the userland register state (if the event occured in kernelspace: the userland register state that was recorded on syscall entry), then walks the stackframes by following framepointers. On ARM, the step from one stackframe to the next one is implemented in arch/arm/kernel/perf_callchain.c as follows: The access_ok() check is intended to prevent a malicious userland process from abusing the perf_event_open() API to leak kernelspace data. However, access_ok() does not actually check anything in set_fs(KERNEL_DS) sections, and performance events can occur in pretty much any context. Therefore, by causing a performance event to fire while e.g. the splice() syscall is running under KERNEL_DS, an attacker can circumvent this protection. After circumventing the protection, the attacker can set up a stackframe whith a controlled return address, and the kernel will happily follow it.
There is a reference count leak in aa_fs_seq_hash_show that can be used to overflow the reference counter and trigger a kernel use-after-free. The fix is just to correctly drop the acquired reference.
The hotfix_upload.cgi file contains a flaw allowing a user to execute commands under the context of the root user. The actual injection takes place in the name of the file being uploaded (ie. filename=”test.txt&id”). By performing the following request, system information is sent back in the response. This gives any user the ability to execute simple non interactive commands. However, more complex (including remote shell) commands are possible. Special characters like ‘/’,'<‘,’>’ are not sent across to the server. But utilizing the environment itself, it becomes possible to insert characters like the ‘/’. Now the attacker has the ability to create a shell by uploading a file containing the following (where [ip address] is your receiving machine).
This module exploits a remote command execution vulnerability in the Barracuda Web Application Firweall firmware versions <= v8.0.1.008 (2016-03-22) by exploiting a vulnerability in the web administration interface. By sending a specially crafted request it's possible to inject system commands while escalating to root do to relaxed sudo configuration on the local machine.
This module exploits a remote command execution vulnerability in the Barracuda Web App Firewall Firmware Version <= 8.0.1.008 and Load Balancer Firmware <= v5.4.0.004 by exploiting a vulnerability in the web administration interface. By sending a specially crafted request it's possible to inject system commands while escalating to root do to relaxed sudo configurations on the applianaces.
A vulnerability has been discovered in the Wordpress Ultimate Product Catalog by affecting v3.9.8 and below (tested). Due to an unsanitized parameter passed to the shortcode function `Insert_Product_Catalog` located in `/Funtions/Shortcodes.php` line 4, the $id parameter is extracted with `extract` function from $atts. This is a vulnerability with which can be exploited by creating shortcodes with malicious attributes, exploitable only by administrators, editors, authors. In file `/Functions/Process_Ajax.php` line 113, the $id parameter can be controlled, leading to a Blind SQL Injection vulnerability.
myscadaPro7 application installs seven (8) services. All these services run as LocalSystem by default, and suffer from an unquoted search path issue. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user’s code would execute with the elevated privileges of the application.
Services By CQR