Category Archives: Full Disclosure

Full Disclosure

WSO2 SOA Enablement Server – XML External Entity Injection

July 12, 2016 007admin

Posted by Paweł Gocyla on Jul 12

Title: WSO2 SOA Enablement Server – XML External Entity Injection
Authors: Pawel Gocyla, Jakub Palaczynski
Date: 08. June 2016

Affected Software:
==================
WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616
Probably other versions are also vulnerable.

Vulnerability:
**************

XML External Entity Injection:
==============================

It must be noted that this vulnerability is exploitable without…

Full Disclosure

WSO2 SOA Enablement Server – Server Side Request Forgery

July 12, 2016 007admin

Posted by Paweł Gocyla on Jul 12

Title: WSO2 SOA Enablement Server – Server Side Request Forgery
Authors: Pawel Gocyla
Date: 10. June 2016

Affected Software:
==================
WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616
Probably other versions are also vulnerable.

Vulnerability:
**************

Server Side Request Forgery (SSRF):
===================================

Using this vulnerability it is possible for example to expose service user
credentials….

Full Disclosure

RCE by abusing NAC to gain Domain Persistence.

July 12, 2016 007admin

Posted by Alexander Korznikov on Jul 12

link:
http://www.korznikov.com/2016/07/rce-by-abusing-nac-to-gain-domain.html

Hi there!
I want to share how to compromise whole enterprise network in less than ONE
minute 🙂

Let’s begin… As security consultants, we often advice to our clients to
implement Network Access Control systems to prevent some nasty people to do
their nasty things…

This article is not about how to bypass Network Access Control systems, but
if you’re…

Full Disclosure

RootExplorer remote code execution

July 12, 2016 007admin

Posted by 0x3d5157636b525761 iddqd on Jul 12

Disclosure timeline
=====================
June 11th: discovered issues.
June 12th: contacted App developer.
June 12th: App developer replies that the new App is not ready yet, but
will not download assets from HTTP.
June 13th: asked how much time it’ll take to fix, App developer didn’t
respond.
July 2nd: App developer queried again, but failed to respond.
July 8th: App developer got his 3rd notice, but failed to respond.
July 9th: full…

Full Disclosure

[CVE-2016-1014, CVE-2016-4247] Executable installers are vulnerable^WEVIL (case 35): Adobe's Flash Player (un)installers

July 12, 2016 007admin

Posted by Stefan Kanthak on Jul 12

Hi @ll,

the executable installers of Flash Player released 2016-06-15
fixed CVE-2016-1014 in the second attempt, but another vulnerability
remained: they create(d) and use(d) UNSAFE temporary subdirectories
into which they copy/ied themselves and extract(ed) a file “fpb.tmp”
which they load(ed) and execute(d) later with elevated privileges.

An unprivileged user can/could overwrite both files between creation
and execution and gain…

Full Disclosure