Multiple web vulnerabilities have been discovered in the Secure Item Hub - WiFi File Sharing mobile iOS wifi web-application. The vulnerabilities include arbitrary file upload, persistent input validation, and persistent cross site scripting. These vulnerabilities allow remote attackers to inject malicious script codes to the application-side of the vulnerable module, as well as upload malicious files to compromise the mobile web-application or connected device.
This module writes and spawns a native payload on an android device that is listening for adb debug messages.
The crash due to a stack-based out-of-bounds read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark. The AddressSanitizer reported a stack-buffer-overflow on address 0x7fffc04c9c20 at pc 0x00000046cc29 bp 0x7fffc04c99b0 sp 0x7fffc04c9160. The memory access at offset 544 overflows the variable 'magic_buf' located in stack of thread T0 at offset 544 in frame 0x7fbfa43611ff in nettrace_3gpp_32_423_file_open wireshark/wiretap/nettrace_3gpp_32_423.c:964.
The vulnerability is a heap-buffer-overflow in pdfium, the Chrome PDF renderer. It was encountered during PDF fuzzing and occurs when a maliciously crafted PDF file is opened. The crash occurs when the opj_j2k_read_mcc function in j2k.c is called, which reads a size of 4 bytes from an address that is out of bounds.
A stack-based buffer overflow vulnerability was discovered in Wireshark, which is a free and open-source packet analyzer. The vulnerability can be triggered by feeding a malformed file to tshark. The stack-based buffer overflow occurs in the ascii_strup_inplace function in the wsutil/str_util.c file. The vulnerability can be exploited to execute arbitrary code.
Api Manager's index.php used tag parameters is vulnerable. An attacker can use sqlmap to exploit this vulnerability and gain access to the database. The sqlmap query used is 'sqlm -u "http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1" --level 4 --dbs --no-cast -p tag' and the result of the query is that the back-end DBMS is MySQL, web server operating system is Linux Ubuntu, web application technology is Apache 2.4.10 and back-end DBMS is MySQL 5.0.11. The query also fetched the names of the databases present in the system.
A unauthenticated SQL injection flaw was discovered within the latest WordPress appointment-booking-calendar plugin version 1.1.23. The flaw were found in the function that is executed when the action ´cpabc_appointments_check_IPN_verification´ is called. The action is added with ´init´ tag, so it function is called every time when parameter ´action=cpabc_appointments_check_IPN_verification´ appear in the query string (GET request) or POST request. But for to execute the vulnerable line of code, an attacker need to carry out some conditions: - The query string must contain the ´cpabc_ipncheck´ parameter. - The ´cpabc_ipncheck´ must have the value ´1´. - The query string muy contain the ´item_number´ parameter. The vulnerable line of code is the following: $myrows = $wpdb->get_results( "SELECT * FROM ".CPABC_APPOINTMENTS_CONFIG_TABLE_NAME." WHERE conwer = ".$item_number ); The ´$item_number´ variable is not sanitized before being used in the SQL query, so an attacker can inject arbitrary SQL code.
A buffer overflow vulnerability exists in the Linux kernel when handling packet filter parameters. An attacker can craft a malicious packet filter configuration structure with a large data length field, which can lead to a buffer overflow and potentially allow arbitrary code execution.
The page diag_backup.php had CSRF checking disabled for all functions, including the restore function. As a result, a specially crafted attacker page could cause a logged-in administrator to upload a config.xml crafted by the attacker.
SCTP (stream control transmission protocol) is a transport-layer protocol designed to transfer signaling messages in an IP environment. This vulnerability threatens FreeBSD systems (versions 9.3, 10.1, and 10.2) if they support SCTP and IPv6 (default configuration). To exploit this flaw, a malefactor needs to send a specially crafted ICMPv6 message. And if he succeeds, he can conduct a DoS attack. Denial of service is caused by improper check of the length of an SCTP packet header received from the ICMPv6 error message. If the target recipient is unavailable, the router can generate an error message and send it to the sender via ICMPv6. This ICMPv6 packet includes the original IPv6 packet where the Next Header field indicates how SCTP is encapsulated. When the kernel receives the error message via ICMPv6, it transfers the upper-level protocol packet to a necessary parser (sctp6_ctlinput()). The SCTP parser considers the incoming header has the required length, tries to copy it using m_copydata(), which has offset values and the number of bytes. Since a twelve-byte chunk is expected, if the attacker sends a packet with an eleven-byte header, a NULL pointer is dereferenced causing kernel panic.
Services By CQR