This Metasploit module exploits a vulnerability in the update functionality of Malwarebytes Anti-Malware consumer before 2.0.3 and Malwarebytes Anti-Exploit consumer 1.03.1.1220. Due to the lack of proper update package validation a man-in-the-middle attacker could execute arbitrary code by spoofing the update server data-cdn.mbamupdates.com and uploading an executable. This Metasploit module has been tested successfully with MBAM 2.0.2.1012 and MBAE 1.03.1.1220.
7ff0974c6eceef6b507a55c91fa7ecc2267e3fb1d468c441797b7a7071ac3090EMC Documentum D2 suffers from sensitive information disclosure and privilege escalation vulnerabilities.
49898d02690c57f2c7516ee625e62143bae3b68445d798ce8a9f9ac48973cdbcFork CMS version 3.8.5 suffers from a remote SQL injection vulnerability.
e872082a2312ec95900f823efdd066a5402dc9f5d5ffa7f7a3cde84fc459392cRed Hat Security Advisory 2015-0126-01 - The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine hypervisor. It includes everything necessary to run and manage virtual machines: a subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application.
d44426ffefcc6444f5b0e9c23919d3d7de8a73feffb3acd51ec8ab0294efb23bCisco Security Advisory - A vulnerability in the administrative web interface of Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute arbitrary commands on the affected system and on the devices managed by the affected system. The vulnerability is due to improper user input validation. An attacker could exploit this vulnerability by crafting input into the affected fields of the web interface.
4b60f20ed92c5b3dd2cdab3380d2c9efe1b3b6db26730e670f2137a6aa271a78Debian Linux Security Advisory 3153-1 - Multiples vulnerabilities have been found in krb5, the MIT implementation of Kerberos.
ecee120847457717a01fd2a9987ef675a6d879e4f16c09674711b8939feb31a6Ubuntu Security Notice 2469-2 - USN-2469-1 fixed vulnerabilities in Django. The security fix for CVE-2015-0221 introduced a regression on Ubuntu 10.04 LTS and Ubuntu 12.04 LTS when serving static content through GZipMiddleware. This update fixes the problem. Various other issues were also addressed.
5dc4cf9fd9fb7b32640fdad08d1ed4b56744197013e1ee313e726c46e7b1c6b6Ubuntu Security Notice 2494-1 - Francisco Alonso discovered that file incorrectly handled certain ELF files. An attacker could use this issue to cause file to crash, resulting in a denial of service. Thomas Jarosch discovered that file incorrectly handled certain ELF files. An attacker could use this issue to cause file to hang or crash, resulting in a denial of service. Thomas Jarosch discovered that file incorrectly limited recursion. An attacker could use this issue to cause file to hang or crash, resulting in a denial of service. Various other issues were also addressed.
a0172d45fde45339ba18deb09206dc0648821b862540859d68b1e3108eff0aaeRed Hat Security Advisory 2015-0125-01 - Red Hat JBoss Web Framework Kit combines popular open source web frameworks into a single solution for Java applications. This release serves as a replacement for Red Hat JBoss Web Framework Kit 2.6.0, and includes bug fixes and enhancements.
458310105b1d75920acc0a556797f379a84d6fbdc2f973508a56558ed2fb7a7aThis Metasploit module exploits multiple vulnerabilities in the WordPress plugin Pixabay Images version 2.3.6. The plugin does not check the host of a provided download URL which can be used to store and execute malicious PHP code on the system.
d111cecf145c4dabb425662dffda4d1cf8b9241d370037c752f93b57412ecb27The Wordpress Theme "platform" contains a remote code execution vulnerability through an unchecked admin_init call. The theme includes the uploaded file from it's temp filename with php's include function.
c111d9d51c266ad61917964f9eea57d1334074e2ca4b8eb80252f3ed807ddc0fPragyan CMS version 3.0 suffers from a remote SQL injection vulnerability.
3b31f0d50387ab584ccc4e28831cdd27727d3f209f7ea910e49918a04b34e73aUbuntu Security Notice 2493-1 - Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage (TLS) implementation allowing users to bypass the espfix to obtain information that could be used to bypass the Address Space Layout Randomization (ASLR) protection mechanism. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory. A flaw was discovered with file renaming in the linux kernel. A local user could exploit this flaw to cause a denial of service (deadlock and system hang). Various other issues were also addressed.
78c1dcddff69907c427b2816efa40b8a09fbf6141aceb7afd6b3af9ee42f1518Ubuntu Security Notice 2491-1 - Andy Lutomirski discovered that the Linux kernel does not properly handle faults associated with the Stack Segment (SS) register in the x86 architecture. A local attacker could exploit this flaw to gain administrative privileges. Lars Bull reported a race condition in the PIT (programmable interrupt timer) emulation in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel. A local guest user with access to PIT i/o ports could exploit this flaw to cause a denial of service (crash) on the host. Various other issues were also addressed.
19a2af96124543aaa352ea18ece1dd413cfb089cee4acb7401e035e68bc63c5cUbuntu Security Notice 2490-1 - Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage (TLS) implementation allowing users to bypass the espfix to obtain information that could be used to bypass the Address Space Layout Randomization (ASLR) protection mechanism. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory. Prasad J Pandit reported a flaw in the rock_continue function of the Linux kernel's ISO 9660 CDROM file system. A local user could exploit this flaw to cause a denial of service (system crash or hang). Various other issues were also addressed.
9ee17d00db7459bc6c51e01f25a03c93b528f10b6763878bf01be7960f03a2edUbuntu Security Notice 2492-1 - Andy Lutomirski discovered an information leak in the Linux kernel's Thread Local Storage (TLS) implementation allowing users to bypass the espfix to obtain information that could be used to bypass the Address Space Layout Randomization (ASLR) protection mechanism. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory. A flaw was discovered with file renaming in the linux kernel. A local user could exploit this flaw to cause a denial of service (deadlock and system hang). Various other issues were also addressed.
8dad5e507e46c620d936929ce8e358be1f8fa17509f76d943ec58a0fdb565fc7
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed