9 - 2016 - :: Deepquest ::

>> Symantec Outdated RAR Decomposer

USER: deepcore // 2016-09-23 // 0 CMT

Symantec Antivirus includes RAR unpacking memory corruption issues that can lead to remote code execution.

>> jsch 0.1.53 Path Traversal

USER: deepcore // 2016-09-23 // 0 CMT

A malicious sftp server may force a client-side relative path traversal in jsch’s implementation for recursive sftp-get allowing the server to write files outside the clients download basedir with effective…

[EXPLOIT]

>> Metasploit Web UI Diagnostic Console Command Execution

USER: deepcore // 2016-09-23 // 0 CMT

This Metasploit module exploits the “diagnostic console” feature in the Metasploit Web UI to obtain a reverse shell. The diagnostic console is able to be enabled or disabled by an…

[EXPLOIT]

>> Kaltura Remote PHP Code Execution

USER: deepcore // 2016-09-23 // 0 CMT

This Metasploit module exploits an Object Injection vulnerability in Kaltura. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the context of the web server user. Kaltura has…

[EXPLOIT]

>> Silverstripe Theme Newedge Cross Site Scripting

USER: deepcore // 2016-09-23 // 0 CMT

Silverstripe theme Newedge suffers from a cross site scripting vulnerability.

[EXPLOIT]

>> Microsoft Internet Explorer 11 CORS Disrespect

USER: deepcore // 2016-09-23 // 0 CMT

Microsoft Internet Explorer 11 is not following the CORS specification for local files like Chrome and Firefox. Microsoft does not believe this to be a security issue.

[EXPLOIT]

>> Kerio Control Unified Threat Management Code Execution / XSS / Memory Corruption

USER: deepcore // 2016-09-23 // 0 CMT

Kerio Control Unified Threat Management versions prior to 9.1.3 suffer from unsafe usage of the PHP unserialize function, code execution, memory corruption, cross site scripting, and various other vulnerabilities.