CVE-2015-0011
published 2015-01-13CVE-2015-0011: mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1…
PriorityP421medium4.7CVSS 2.0
AVLACMAuNCNICAN
EPSS
2.01%
78.6th percentile
mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
BMC BladeLogic 8.3.00.64 - Remote Command Execution
exploitdb·2018-01-26·CVSS 7.5
CVE-2016-1543 [HIGH] BMC BladeLogic 8.3.00.64 - Remote Command Execution
BMC BladeLogic 8.3.00.64 - Remote Command Execution
---
# Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version
# Filename: BMC_rexec.py
# Github: https://github.com/bao7uo/bmc_bladelogic
# Date: 2018-01-24
# Exploit Author: Paul Taylor / Foregenix Ltd
# Website: http://www.foregenix.com/blog
# Version: BMC RSCD agent 8.3.00.64
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
# Vendor Advisory: https://docs.bmc.com/docs/ServerAutomation/87/release-notes-and-notices/flashes/notification-of-critical-security-issue-in-bmc-server-automation-cve-2016-1542-cve-2016-1543
# Tested on: 8.3.00.64
#!/usr/bin/python
# BMC BladeLogic RSCD agent remote exec - XMLRPC version
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
# By Paul Taylor / Fore
Exploit-DB
AirLink101 SkyIPCam1620W - OS Command Injection
exploitdb·2015-07-08·CVSS 8.8
CVE-2015-2280 [HIGH] AirLink101 SkyIPCam1620W - OS Command Injection
AirLink101 SkyIPCam1620W - OS Command Injection
---
1. Advisory Information
Title: AirLink101 SkyIPCam1620W OS Command Injection
Advisory ID: CORE-2015-0011
Advisory URL: http://www.coresecurity.com/advisories/airlink101-skyipcam1620w-os-command-injection
Date published: 2015-07-08
Date of last update: 2015-07-08
Vendors contacted: AirLink101
Release mode: User release
2. Vulnerability Information
Class: OS Command Injection [CWE-78], Use of Hard-coded Credentials" [CWE-798]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2015-2280
3. Vulnerability Description
AirLink101 [2] SkyIPCam1620W Wireless N MPEG4 3GPP Network Camera streams supreme quality MPEG4 and MJPEG image. It supports remote surveillance on computers over the Internet or on mob
Talos
Microsoft Update Tuesday January 2015: Another Light Month, No IE
Bulletins, More Changes to Reporting
blogs_talos·2015-01-13·CVSS 7.2
[HIGH] Microsoft Update Tuesday January 2015: Another Light Month, No IE
Bulletins, More Changes to Reporting
This post was written by Yves Younan.
Microsoft’s first Update Tuesday of 2015 is pretty light, there’s a total of eight bulletins, all covering a single vulnerability. Seven of these bulletins are rated as important and just one is rated critical. No bulletin for IE is being released this month. Two of the vulnerabilities were publicly disclosed prior to today, while another one was being actively exploited by attackers.
Microsoft made a number of changes to Update Tuesday last month, such as dropping deployment priority in favor of their exploitability index (XI). This month more changes were made to the program: Microsoft is no longer providing their Advance Notification Service (ANS) to the general public, but is instead only providing it to premier customers.
The first bulletin of
Talos
Microsoft Update Tuesday January 2015: Another Light Month, No IE
Bulletins, More Changes to Reporting
blogs_talos·2015-01-13·CVSS 7.2
[HIGH] Microsoft Update Tuesday January 2015: Another Light Month, No IE
Bulletins, More Changes to Reporting
## Microsoft Update Tuesday January 2015: Another Light Month, No IE
Bulletins, More Changes to Reporting
This post was written by Yves Younan .
Microsoft’s first Update Tuesday of 2015 is pretty light, there’s a total of eight bulletins, all covering a single vulnerability. Seven of these bulletins are rated as important and just one is rated critical. No bulletin for IE is being released this month. Two of the vulnerabilities were publicly disclosed prior to today, while another one was being actively exploited by attackers.
Microsoft made a number of changes to Update Tuesday last month, such as dropping deployment priority in favor of their exploitability index (XI). This month more changes were made to the program: Microsoft is no longer providing their Advance Notification Service
Zscaler
Zscaler found Multiple Security Vulnerabilities | 01-13-2015
blogs_zscaler
Zscaler found Multiple Security Vulnerabilities | 01-13-2015
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bugzilla
CVE-2015-3255 polkit: Heap-corruption on duplicate ids
bugzilla·2015-07-22·CVSS 4.6
CVE-2015-3255 [MEDIUM] CVE-2015-3255 polkit: Heap-corruption on duplicate ids
CVE-2015-3255 polkit: Heap-corruption on duplicate ids
It was reported that if polkit, while reading action descriptions from /usr/share/polkit-1/actions, encounters a duplicate action ID, it corrupts the heap.
The effects of corruption are e.g. visible on stderr as frequent use of unrelated strings when running polkit without --no-debug.
Presumably a local attacker might be able to manipulate polkit’s heap enough to achieve privilege escalation through this.
Upstream bug: https://bugs.freedesktop.org/show_bug.cgi?id=83590
Upstream patch is attached.
Discussion:
Created attachment 1054865
0011-Fix-GHashTable-usage.patch
---
How is this a security issue?
Or is it due if the heap is corrupted that an attacker can work on top of that?
---
Heap corruptions are, depending on your poin
http://secunia.com/advisories/62154http://www.securityfocus.com/bid/71960http://www.securitytracker.com/id/1031531https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-008https://exchange.xforce.ibmcloud.com/vulnerabilities/99526https://exchange.xforce.ibmcloud.com/vulnerabilities/99527http://secunia.com/advisories/62154http://www.securityfocus.com/bid/71960http://www.securitytracker.com/id/1031531https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-008https://exchange.xforce.ibmcloud.com/vulnerabilities/99526https://exchange.xforce.ibmcloud.com/vulnerabilities/99527
2015-01-13
Published