This archive contains all of the 170 exploits added to Packet Storm in October, 2019.
bd2d581d813158abc225eacce35210eeee1d84351b3fabaa41a98d371247ca63The Carel pCOWeb card stores password hashes in the file /etc/passwd, allowing privilege escalation by authenticated users. Additionally, plaintext copies of the passwords are stored. Version A 1.4.11 - B 1.4.2 is affected.
450784ac7f42fa743218fbb60bd08f3732984399df8feaaeb904aaf749417707The Carel pCOWeb card exposes a Modbus interface to the network. By design, Modbus does not provide authentication, allowing to control the affected system. Version A 1.4.11 - B 1.4.2 is affected.
ac9bdcf7f91e77dced7f5e7b4acb37e4fb6d3eaa097d2b650f4b1e1128e1c5f9This Metasploit module exploits a remote command execution vulnerability in Nostromo versions 1.9.6 and below. This issue is caused by a directory traversal in the function http_verify in nostromo nhttpd allowing an attacker to achieve remote code execution via a crafted HTTP request.
1baffab9687f81feac9fe65275eba574314a19a248d0ee583a4ac8f7f390b032WordPress Google Review Slider plugin version 6.1 suffers from a remote SQL injection vulnerability.
911c95419821334da71eefac39a1736f977de60c9cfdd08de57af973e356d0a4WMV to AVI MPEG DVD WMV Converter version 4.6.1217 suffers from a buffer overflow vulnerability.
8d7b9c4e9eac2146af29c7dd55d6367cd28e4dfe7145bef186543371c430ddabMikroTik RouterOS version 6.45.6 DNS cache poisoning exploit.
a383237105abf2d8cd196092df38ab74a7bb21e90a231ec004bccdee62539d22iSeeQ Hybrid DVR WH-H4 versions 1.03R and 2.0.0.P suffer from an unauthenticated and unauthorized live stream disclosure vulnerability when get_jpeg script is called.
2527c2f23c073d2297e68ff7e40a00e0d9b7718b04646a0169d6462b16fd1c31JavaScriptCore (JSC) GetterSetter suffers from a type confusion vulnerability during DFG compilation.
f8e60930397de757314b85c289c63228a5b19761b6793d77e58b54ffc9aab262Citrix StoreFront Server version 7.15 suffers from an XML external entity injection vulnerability.
179c0d1aea2e1a88c424e879d0658af19c0726c2fbf5308693fd30506d076ec8WMV to AVI MPEG DVD WMV Converter version 4.6.1217 suffers from a denial of service vulnerability.
8beb518893d841f080cf953c404ca650f462bddc06447c5f6a5f61191e6b8233Craft CMS versions up to 3.1.7 are missing rate limiting on password validations.
e26079a4a65a4669c9d8c5046a323f66dfea3ad1774ae2ef65e4b26a2599bda8WordPress version 5.2.4 fails to validate an origin header.
3221b6e70ffc3ec1c88a8712fb1a47505186d32fb600ff75143ab8214bae1b44Microsoft Windows Server 2012 suffers from a Group Policy security feature bypass vulnerability.
42e75c649b3a34baa9f25a162f0d99b56d845c88939bbbb7777ef5180b69b4c1Microsoft Windows Server 2012 suffers from a Group Policy remote code execution vulnerability.
ccee66c4da6a5faeef607aa1f1de3ca83459c118bc6de48ff5ae4627c94bc717rConfig version 3.9.2 suffers from a remote code execution vulnerability.
b12301a0ed841ed2491b8a64294909e610a8429eb92ca588af2b200c19495a88Win10 MailCarrier version 2.51 POP3 User remote buffer overflow exploit.
13098e760a816ccb94607e0bf00c0b7ce7100d3be40e32babf503a1307f8b8a4Intelligent Security System SecurOS Enterprise version 10.2 suffers from a SecurosCtrlService unquoted service path vulnerability.
e428c23c2cb0567738fb62cfe8f548064e641f605aefd572c01794d88da88d84Microsoft Windows suffers from an insecure CSharedStream object privilege escalation vulnerability.
9abd67b8467f3e60623b8e86d9c7f4d8fade22c3b12d417cba3715c52580f6f9WebKit suffers from an HTMLFrameElementBase::isURLAllowed universal cross site scripting vulnerability.
408eee81bf05626112665dd417b2dde7924a6d1ed0dadfd93c8ea516c4f61b79Infosysta Jira version 1.6.13_J8 suffers from a user name disclosure vulnerability.
506fa47855ab00052d2c3b374f021b09caf1e85be4e4a010161eed8775c5f5b8Infosysta Jira version 1.6.13_J8 suffers from an authentication bypass vulnerability that allows you to see project lists.
5759cf071d560c4da28fae8baa88ebacb2d306e5d1cfc0ae9d1a454907d296b8Infosysta Jira version 1.6.13_J8 suffers from an authentication bypass vulnerability that allows you to see push notifications for a given user.
01fd0ed65d6bb484afc3a2b833eae1e73bda43947aa08a133d177919fadef778ChaosPro version 2.0 SEH buffer overflow exploit.
ddd69b766e659956f62f3d710f3028d2e19dcc240bbf9bd5d345931c410c2237waldronmatt FullCalendar-BS4-PHP-MySQL-JSON version 1.21 suffers from a cross site scripting vulnerability.
7bd33179e72f3eb2716b76f370cbc499c313b43e1c9a043a65fb9a2c48300585
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed