The Latest Infosec News, Tools, and Exploits – Got Root?
#Advisory ID: SGMA18-002 #Title: Tor Browser Deanonymization With SMB #Product: Tor Browser < 8.0, Firefox < 62 / < 60.2.0esr #Vendor: torproject.org, mozilla.org #Type: Information Disclosure #Risk level: 4 / 5 #Credits: filippo.cavallarin@wearesegment.com #CVE: CVE-2017-16639 […]
# Exploit Title: MyBB 1.8.17 – Cross-Site Scripting # Date: 2018-08-11 # Author: 0xB9 # Twitter: @0xB9Sec # Contact: 0xB9[at]pm.me # Software Link: https://mybb.com/download/ # Version: 1.8.17 # Tested on: Ubuntu 18.04 # CVE: CVE-2018-15596 […]
# Exploit Title: FUJI XEROX DocuCentre-V 3065 Printer – Remote Command Execution # Date: 2018-09-05 # Exploit Author: vr_system # Vendor Homepage: https://www.fujixerox.com.cn/ # Software Link: https://www.fujixerox.com.cn/ # Version: DocuCentre-IV,DocuCentre-VI,DocuCentre-V,ApeosPort-VI,ApeosPort-V # Tested on: DocuCentre-V 3065,ApeosPort-VI […]
# Exploit Title: FTPShell Server 6.80 – ‘Add Account Name’ Buffer Overflow (SEH) # Discovery by: Luis Martinez # Discovery Date: 2018-09-04 # Vendor Homepage: http://www.ftpshell.com/ # Software Link: http://www.ftpshell.com/downloadserver.htm # Tested Version: 6.80 # […]
# Exploit Title: Wikipedia 12.0 – Denial of Service (PoC) # Date: 9/2/2018 # Author: 0xB9 # Twitter: @0xB9Sec # Contact: 0xB9[at]pm.me # Software Link: https://www.microsoft.com/en-us/p/wikipedia/9wzdncrfhwm4?activetab=pivot%3aoverviewtab # Version: 12.0 # Tested on: Windows 10 # […]
# Exploit Title: Eaton Xpert Meter 13.4.0.10 – SSH Private Key Disclosure # Date: 2018-07-16 # WebPage: https://CTRLu.net/ # Vendor Homepage: http://www.eaton.com/ # Vendor Advisory: http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf # Software Link: http://www.eaton.com/Eaton/ProductsServices/Electrical/ProductsandServices/PowerQualityandMonitoring/PowerandEnergyMeters/PowerXpertMeter400060008000/index.htm#tabs-2 # Version: Firmware <= 12.x […]
# Exploit Title: WordPress Plugin Export Users to CSV 1.1.1 – CSV Injection # Exploit Author: Javier Olmedo # Website: https://hackpuntes.com # Date: 2018-08-14 # Google Dork: N/A # Vendor: Matt Cromwell # Software Link: […]
# Title: ASUS-DSL N10 1.1.2.2_17 – Authentication Bypass # Author: AmnBAN team # Date: 2018-08-06 # Vendor Homepage: https://www.asus.com/Networking/DSLN10_C1_with_5dBi_antenna/ # Sofrware version: 1.1.2.2_17 # CVE: N/A # 1. Description: # In ASUS-DSL N10 C1 modem […]
# Exploit Title: ASUS DSL-N12E_C1 1.1.2.3_345 – Remote Command Execution # Date: 2018-08-02 # Exploit Author: Fakhri Zulkifli (@d0lph1n98) # Vendor Homepage: https://www.asus.com/ # Software Link: https://www.asus.com/Networking/DSLN12E_C1/HelpDesk_BIOS/ # Version: 1.1.2.3_345 # Tested on: 1.1.2.3_345\ Method […]
This module exploits a vulnerability in SonicWall Global Management System Virtual Appliance versions 8.1 (Build 8110.1197) and below. This virtual appliance can be downloaded from http://www.sonicwall.com/products/sonicwall-gms/ and is used ‘in a holistic way to manage […]
