Dhiren Vaghela – Page 12 – Qualys ThreatPROTECT

Grandnode Path Traversal Arbitrary file download vulnerability

Posted by Dhiren Vaghela on September 8, 2019June 7, 2020

Summary: A path traversal vulnerability has been reported in Grandnode. LetsEncryptController.cs in the Index action method is the vulnerable component., via which the server access the token validation URL, without authentication. Description: Grandnode is an open-source eCommerce solution powered by .NET Core 2.2, supporting Windows, Linux and Mac operating systems. LetsEncryptController.cs method is used in … Continue reading “Grandnode Path Traversal Arbitrary file download vulnerability”

LibreOffice Code Execution Vulnerability CVE-2019-9848

Posted by Dhiren Vaghela on July 30, 2019June 7, 2020Video

Summary: Recently, LibreOffice have been reported with a remote code execution vulnerability. The LibreLogo scripts is the vulnerable component due to which the doc event feature being permitted to execute allows the execution of Python code. Description: A programmable turtle vector graphics script called as LibreLogo comes along LibreOffice product that can be manipulated into … Continue reading “LibreOffice Code Execution Vulnerability CVE-2019-9848”

Atlassian Crowd pdkinstall Remote Code execution CVE-2019-11580

Posted by Dhiren Vaghela on July 19, 2019June 7, 2020

Summary: A remote code execution vulnerability has been reported in Atlassian Crowd and Crowd Data Center. The vulnerability is due to pdkinstall development plugin is incorrectly enabled in release builds. Description: Atlassian Crowd, a user management application for access control for Active Directory (AD), Lightweight Directory Access Protocol (LDAP)OpenLDAP and Microsoft Azure AD. A remote, … Continue reading “Atlassian Crowd pdkinstall Remote Code execution CVE-2019-11580”

Microsoft Windows Privilege Escalation vulnerabilities CVE-2019-1132 & CVE-2019-0880

Posted by Dhiren Vaghela on July 15, 2019June 7, 2020

Summary: In the month of July 2019, MSPT have several vulnerabilities including windows kernel, win32K, unistore.dll, Hyper-V, Windows WLAN service, Windows Audio service, Windows RPCSS, DirectX, windows dnslvr.dll in Microsoft Windows. Out of them two zero days were identified for actively Attacked Privilege Escalation vulnerabilities (CVE-2019-1132 and CVE-2019-0880) in Win32k and splwow64 that have been … Continue reading “Microsoft Windows Privilege Escalation vulnerabilities CVE-2019-1132 & CVE-2019-0880”