Category Archives: Full Disclosure

Full Disclosure

Tap 'n' Sniff

Posted by Curesec Research Team (CRT) on Jan 19

Content Table

1. Introduction
2. Failsafe mode
3. Installing Openwrt
4. Configuring Openwrt
5. Testing

1. Introduction

The goal of this guide is to provide a reliable and fast way for creating a lan
tap for red team assessments of networks. While this was our main target this
tap is also quite helpful if you want to have a great device for your daily
analysis of network attached computers. Before we started with our
implementation we made a…

[RCESEC-2016-012] Mattermost <= 3.5.1 "/error" Unauthenticated Reflected Cross-Site Scripting / Content Injection

Posted by Julien Ahrens on Jan 19

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Mattermost
Vendor URL: www.mattermost.org
Type: Cross-Site Scripting [CWE-79]
Date found: 02/12/2016
Date published: 16/01/2017
CVSSv3 Score: 4.7 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)
CVE: –

2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE…

Persistent XSS in Ghost 0.11.3

Posted by Patrick on Jan 19

=====[ Tempest Security Intelligence – ADV-9/2017 ]========================

Persistent Cross-Site Scripting (XSS) in Ghost
——————————————————-
Author:
– Patrick Costa < patrickrbcosta () gmail.com >

Tempest Security Intelligence – Recife, Pernambuco – Brazil

=====[ Table of Contents ]=================================================

1. Overview
2. Detailed description
3….

CALL FOR PAPERS – br3aking c0de

Posted by Estación Informática on Jan 19

{About br3aking c0de}
Congress of security alternative and different. Speak freely without
censorship. Assistance only for guests or through acceptance of call for
paper CFP.
—————————————————————————————————-
{Submit}
br3akingc0de[at]br3akingc0de[dot]com
—————————————————————————————————-
{PGP Key}
0x9F162B3B <…

[ERPSCAN-16-036] SAP ASE ODATA SERVER – DENIAL OF SERVICE

Posted by ERPScan inc on Jan 19

Application: SAP ASE

Versions Affected: SAP ASE ODATA Server v16

Vendor URL: http://SAP.com

Bugs: Denial of Service

Sent: 01.02.2016

Reported: 02.02.2016

Vendor response: 02.02.2016

Date of Public Advisory: 12.10.2016

Reference: SAP Security Note 2330422

Author: Vahagn @vah_13 Vardanyan (ERPScan)

Description

1. ADVISORY INFORMATION

Title:[ERPSCAN-16-036] SAP ASE ODATA SERVER – DENIAL OF SERVICE

Advisory ID:[ERPSCAN-16-036]

Risk:…

APPLE-SA-2017-01-18-2 Logic Pro X 10.3

Posted by Apple Product Security on Jan 19

APPLE-SA-2017-01-18-2 Logic Pro X 10.3

Logic Pro X 10.3 is now available and addresses the following:

Projects
Available for: OS X Yosemite v10.10 and later (64 bit)
Impact: Opening a maliciously crafted GarageBand project file may
lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2372: Tyler Bohan of Cisco Talos

Installation note:

Logic Pro X 10.3 may be obtained…

APPLE-SA-2017-01-18-1 GarageBand 10.1.5

Posted by Apple Product Security on Jan 19

APPLE-SA-2017-01-18-1 GarageBand 10.1.5

GarageBand 10.1.5 is now available and addresses the following:

Projects
Available for: OS X Yosemite v10.10 and later
Impact: Opening a maliciously crafted GarageBand project file may
lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved
memory handling.
CVE-2017-2372: Tyler Bohan of Cisco Talos

Installation note:

GarageBand 10.1.5 may be obtained from…

[ERPSCAN-16-037] SAP NetWeaver AS JAVA P4 – INFORMATION DISCLOSURE

Posted by ERPScan inc on Jan 19

Application: SAP NetWeaver AS JAVA

Versions Affected: SAP NetWeaver AS JAVA 7.11-7.4

Vendor URL: http://SAP.com

Bugs: Information disclosure

Sent: 10.03.2016

Reported: 11.03.2016

Vendor response: 11.03.2016

Date of Public Advisory: 12.10.2016

Reference: SAP Security Note 2331908

Author: Vahagn @vah_13 Vardanyan (ERPScan)

Description

1. ADVISORY INFORMATION

Title:[ERPSCAN-16-037] SAP NetWeaver AS JAVA P4 MSPRUNTIMEINTERFACE…

Announce Keypatch v2.1, a better assembler for IDA Pro!

Posted by Nguyen Anh Quynh on Jan 18

Greetings,

We are happy to release Keypatch v2.1, the open-source award-winning
assembler tool for IDA Pro!

Based on Keystone engine, this new version of Keypatch brings some
important features, as follows.

– Added a new function to search for assembly instructions, so it is easy
to grep for ROP gadgets in the binary. This will be helpful for
exploitation writers.
– Removed the “Assembler” function, which is redundant since now you…

SEC Consult SA-20170117-0 :: XSS in Recommend Page extension for TYPO3 CMS (pb_recommend_page)

Posted by SEC Consult Vulnerability Lab on Jan 17

SEC Consult Vulnerability Lab Security Advisory < 20170117-0 >
=======================================================================
title: Cross Site Scripting (XSS)
product: Recommend Page extension for TYPO3 CMS (pb_recommend_page)
vulnerable version: <=2.0.3
fixed version: –
CVE number: –
impact: Medium
homepage: https://typo3.org/
found: 2016-10-21…