On the 17th of July, an advisory addressing a access bypass vulnerability was made public. This was assigned CVE-2019-6342 by MITRE and the associated security risk was deemed critical by Drupal in SA-CORE-2019-008. Vulnerability Details: An access bypass condition allows an attacker to bypass security restrictions in place to perform certain actions. The vulnerability exists … Continue reading “Drupal Wordspaces Module Access Bypass Vulnerability (SA-CORE-2019-008)”
Author: Mayuresh Dani
Exim Remote Command Execution Vulnerability (CVE-2019-10149)
The Exim mail transfer agent (MTA) contains a vulnerability that can allow attackers to execute arbitrary commands reliably on a targeted system. This vulnerability was discovered by our own Qualys Security Research Team and has been named as “The Return of the WIZard” as a reference to a couple of similar command execution vulnerabilities in … Continue reading “Exim Remote Command Execution Vulnerability (CVE-2019-10149)”
Adobe Flash Player Use After Free Vulnerability: APSB18-42
A publicly exploited use after free vulnerability leading to arbitrary code execution was discovered in the Adobe Flash Player. Adobe has addressed this vulnerability in APSB18-42, by releasing the latest version – 32.0.0.101. An additional insecure library loading vulnerability, which leads with privilege escalation via DLL hijacking attacks was also remediated via this update. MITRE has assigned CVE-2018-15982 … Continue reading “Adobe Flash Player Use After Free Vulnerability: APSB18-42”
Cryptocurrency Mining JavaScript Libraries
Introduction: Cryptocurrency is a digital asset designed to work as a medium of exchange using cryptography to secure the transactions and to control the creation of additional units of the currency. One of the most popular cryptocurrency today is the Bitcoin. New units of cryptocurrency are generated by “mining” for them using miners. Users can … Continue reading “Cryptocurrency Mining JavaScript Libraries”
Execution of Untrusted Microsoft Office Macros Permitted
Microsoft Office is an office suite of applications, servers, and services developed by Microsoft for Windows and Mac OS platforms. The suite most notably consists of applications such as Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Access, Microsoft Publisher, Microsoft Project, Microsoft Visio, Microsoft Outlook among others. In addition to features such as word processing, … Continue reading “Execution of Untrusted Microsoft Office Macros Permitted”
Microsoft IIS 6.0 ScStoragePathFromUrl Buffer Overflow Zero Day Vulnerability
Four days ago, a potent proof-of-concept code exploiting an end-of-life software, the Microsoft Internet Information Services 6.0 was released. At this point of time – 4 days after the well publicized release of the PoC, the internet still has 607,134 publicly facing web servers! Of these, 286,068 servers are located in the United States. The March … Continue reading “Microsoft IIS 6.0 ScStoragePathFromUrl Buffer Overflow Zero Day Vulnerability”
WordPress REST API User Enumeration Abuse
WordPress is a popular, open source, blogging tool and content management system based on PHP and MySQL. According to the latest BuiltWith statistics, a total of 18,619,652 live websites use WordPress! That figure is 5% of the total internet websites! About three months ago with the advent of WordPress 4.7, support for REpresentational State Transfer … Continue reading “WordPress REST API User Enumeration Abuse”
NTPD read_mru_list() DoS Layman Analysis
Background: NTP stands for Network Time Protocol, which is a UDP based protocol designed to synchronize clocks of devices over a network with Coordinated Universal Time (UTC). In it’s fourth version, it is one of the oldest networking protocols. NTP.org implemented this as a daemon. Many vendors use this implementation in their products. In it’s … Continue reading “NTPD read_mru_list() DoS Layman Analysis”
WordPress Neosense Theme Zero Day
WordPress is the de-facto open source content management system written in PHP with over 17,000,000 publicly (!) detected installations. Want to make money with your programming skills and WordPress? Easy peasy! Simply develop a theme or a plugin, include other open source products and start making money. It is that easy if you have decent … Continue reading “WordPress Neosense Theme Zero Day”