Subscribe via feed.
Archive for April, 2017

Solarwinds LEM 6.3.1 Sudo Script Abuse Privilege Escalation

Posted by deepcore under exploit (No Respond)

An attacker can abuse functionality provided by a script which may be run with root privilege in order to elevate privilege on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1.

Solarwinds LEM 6.3.1 Shell Escape Command Injection

Posted by deepcore under exploit (No Respond)

Insufficient input validation in the management interface can be leveraged in order to execute arbitrary commands. This can lead to (root) shell access to the underlying operating system on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1.

Solarwinds LEM 6.3.1 Management Shell Arbitrary File Read

Posted by deepcore under exploit (No Respond)

The management shell on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1 allows the end user to edit the MOTD banner displayed during SSH logon. The editor provided for this is nano. This editor has a keyboard mapped function which lets the user import a file from the local file system into the editor. […]

Solarwinds LEM 6.3.1 Hardcoded Credentials

Posted by deepcore under exploit (No Respond)

The Postgres database on Solarwinds Log and Event Manager Virtual Appliance version 6.3.1 has default hardcoded credentials. While some security measures were taken to ensure that network connectivity to the Postgres database wouldn’t be possible using IPv4, the same measures were not taken for IPv6.

Microsoft Office Word Malicious Hta Execution

Posted by deepcore under exploit (No Respond)

This Metasploit module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how an olelink object can make a http(s) request, and execute hta code in response. This bug was originally seen being exploited in the wild starting in Oct 2016. […]

Safari Browser Memory Corruption

Posted by deepcore under exploit (No Respond)

Safari suffers from an out-of-bounds memcpy in Array.concat that can lead to memory corruption.

WordPress Connection Information Cross Site Request Forgery

Posted by deepcore under exploit (No Respond)

The FTP/SSH form functionality of WordPress was found to be vulnerable to cross site request forgery. WordPress versions 4.5.3 through 4.7.4 are affected.

Oracle Java 64bit DLL Hijacking

Posted by deepcore under exploit (No Respond)

A code injection through DLL sideloading vulnerability exists in 64-bit Oracle Java.

eBay Auction Premium Clone Script 6.42 SQL Injection

Posted by deepcore under exploit (No Respond)

eBay Auction Premium Clone Script version 6.42 suffers from a remote SQL injection vulnerability.

Exponent CMS 2.4.1 SQL Injection

Posted by deepcore under exploit (No Respond)

Exponent CMS versions 2.4.1 and below suffer from a remote SQL injection vulnerability.