:: Deepquest ::

Linux Kernel version 4.4 (Ubuntu 16.04) suffers from a snd_timer_user_ccallback() kernel pointer leak vulnerability.

This Metasploit module uses the Liferay CE Portal Groovy script console to execute OS commands. The Groovy script can execute commands on the system via a [command].execute() call. Valid credentials for an application administrator user account are required. This module has been tested successfully with Liferay CE Portal Tomcat 7.1.2 ga3 on Debian 4.9.18-1kali1 system.

Core FTP 2.0 build 653 – ‘PBSZ’ Denial of Service (PoC)

PilusCart 1.4.1 – Cross-Site Request Forgery (Add Admin)

http://www.huorua.go.th/d_finance/new_finance/ooo.jpg notified by KURD ELECTRONIC TEAM

http://www.nongsangwapi.go.th/f_rules/new_rules/ooo.jpg notified by KURD ELECTRONIC TEAM

PRTG Network Monitor 18.2.38 – Authenticated Remote Code Execution

Linux/x86 – MMX-XOR Encoder / Decoder execve(/bin/sh) Shellcode (44 bytes)

NetSetMan 4.7.1 – Local Buffer Overflow (SEH Unicode)

Linux Kernel 4.4 (Ubuntu 16.04) – ‘snd_timer_user_ccallback()’ Kernel Pointer Leak