Overview: A security researcher has publicly disclosed the details of a zero-day vulnerability in Microsoft Internet Explorer 11. Internet Explorer is vulnerable to XML External Entity attack if a user opens a specially crafted .MHT file. From techtarget.com, “MHT is a Web page archive file format. The archived Web page is an MHTML (short for … Continue reading “Microsoft Internet Explorer XML External Entity (XXE) Vulnerability – Zero Day”
ThinkPHP Remote Code Execution Vulnerability
Recently, ThinkPHP released an advisory, for a high-risk remote code execution (RCE) vulnerability. The vulnerability exists because ThinkPHP framework improperly checks controller names. This may lead to possible getshell vulnerabilities without the forced routing enabled. A proof of concept (PoC) exploiting this vulnerability was also published soon after the advisory. The proof-of-concept code exploits a … Continue reading “ThinkPHP Remote Code Execution Vulnerability”
Apache Solr Config API Remote Code Execution Vulnerability (CVE-2019-0192)
Apache has recently fixed a Java Deserialization vulnerability in Apache Solr. Apache Solr has a Config API which allows to configure Solr’s JMX server via an HTTP POST request. It’s possible to setup a malicious RMI server, have Config API point to this malicious RMI server and trigger a remote code execution via Apache Solr’s unsafe … Continue reading “Apache Solr Config API Remote Code Execution Vulnerability (CVE-2019-0192)”
Drupal Remote Code Execution Vulnerability (SA-CORE-2019-003)
Recently, Drupal released a patch for a critical remote code execution vulnerability (SA-CORE-2019-003), tracked as CVE-2019-6340. This vulnerability can be easily exploited by a remote attacker to execute arbitrary code on the targeted system when the RESTful Web Services module is enabled and the GET, POST, PATCH or POST method request is allowed. This isn’t … Continue reading “Drupal Remote Code Execution Vulnerability (SA-CORE-2019-003)”
Nexus Repository Manager 3 Remote Code Execution Vulnerability (CVE-2019-7238)
Sonatype released a patch earlier this month that fixes a Remote Code Execution (RCE) vulnerability in Nexus Repository Manager 3. The vulnerability exists because Nexus Repository Manager fails to implement Access Controls properly which leads to Remote Code Execution vulnerability. This vulnerability affects Nexus Repository Manager 3.6.2 OSS/Pro versions up to and including 3.14.0. Vulnerability Analysis: … Continue reading “Nexus Repository Manager 3 Remote Code Execution Vulnerability (CVE-2019-7238)”
Snapd (Dirty Sock) Privilege Escalation Vulnerability
A privilege escalation vulnerability referred as “Dirty Sock” has been identified in the default installations of Ubuntu Linux. The actual vulnerability is in the Snapd daemon (snapd REST API), which is included by default with all recent Ubuntu versions and probably other Linux distros. Dirty Sock is a local privilege escalation flaw that lets attackers … Continue reading “Snapd (Dirty Sock) Privilege Escalation Vulnerability”
runc Container Escape Vulnerability: CVE-2019-5736
runC is a lightweight portable container runtime. Its designed to create containers as per Open Container Initiative (OCI). A vulnerability in runC module allows a crafted (malicious) container (created using runC) to overwrite the host OS runC binary. The compromised host runC module can be further used to execute root commands on the host OS. … Continue reading “runc Container Escape Vulnerability: CVE-2019-5736”
Cisco Small Business Router Vulnerabilities
Two vulnerabilities have been disclosed in the Cisco’s Small Business Routers RV320 and RV325. CVE-2019-1652: Routers Command Injection Vulnerability A command injection vulnerability has been disclosed in Cisco Small Business routers RV320 and RV325 on firmware versions 1.4.2.15 through 1.4.2.19. CVE-2019-1652 has been assigned to track this vulnerability. An attacker can target this vulnerability by sending … Continue reading “Cisco Small Business Router Vulnerabilities”
Multiple Systemd Vulnerabilities
Qualys has disclosed 3 vulnerabilities in systemd-journald, it has been named “System Down: A systemd-journald exploit” . systemd-journald is a system service that is responsible for collecting and storing logging data. It receives data from various sources like Kernel log messages, system log messages, Structured system log messages, Audit records etc CVE-2018-16864 and CVE-2018-16865 are memory corruptions … Continue reading “Multiple Systemd Vulnerabilities”
Palo Alto Networks Expedition (Migration Tool) Unauthenticated Command Injection Vulnerability
A remote command injection vulnerability has been identified in Palo Alto Expedition (Migration Tool) . Expedition tool is used for moving firewall configurations from another vendor to Palo Alto’s product. It makes the conversion process easier to accomplish. MITRE has assigned CVE-2018-10143 for this vulnerability. Vulnerability Analysis: This vulnerability exists in convertCSVtoParquet.php which accepts user controlled input in a path … Continue reading “Palo Alto Networks Expedition (Migration Tool) Unauthenticated Command Injection Vulnerability”
