Full Disclosure

Piwigo - CVE-2023-26876

April 28^th 2023 at 08:38

Posted by Rodolfo Tavares via Fulldisclosure on Apr 28

=====[ Tempest Security Intelligence - ADV-03/2023
]==========================

Piwigo - Version 13.5.0

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]==================================================
* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgments
* References

=====[ Vulnerability...

Full Disclosure

Re: Checking existence of firewalled URLs via javascript's script.onload

April 28^th 2023 at 08:34

Posted by Jonathan Gregson via Fulldisclosure on Apr 28

Hi Georgi,

As you suggested, this is a CSRF attack. Using such techniques to attack or enumerate local applications has been known
for some time and is a very difficult issue to address. Browsers have done well in preventing malicious _authenticated_
cross-site requests, but as you've found, attackers can still use such techniques for enumeration and information
gathering.

Fortunately, it's not very practical except in targeted...

Full Disclosure

Security vulnerabilities in Telit Cinterion IoT (formerly Thales) devices

April 24^th 2023 at 08:42

Posted by Security Explorations on Apr 24

Hello,

In 2020, a vulnerability (CVE-2020-15858) in multiple Cinterion IoT
devices was discovered by Adam Laurie and Grzegorz Wypych of IBM
X-Force Red [1].

The issue was described as allowing for organizational secrets theft
and Java application code access. The use of Java VM / apps by
wireless (connected) devices triggered my attention in particular.

Historically, Java flaws could be successfully exploited for a more
in-depth investigation...

Full Disclosure

Checking existence of firewalled web servers in Firefox via iframe.onload

April 21^st 2023 at 19:05

Posted by Georgi Guninski on Apr 21

In short in Firefox 112, it is possible to check existence
of firewalled web servers. This doesn't work in Chrome and Chromium 112
for me.

If user A has tcp connection to web server B, then in the
following html:

<iframe src="http://B" onload="load()" onerror="alert('error')" id="i1" />

the javascript function load() will get executed if B serves
valid document to A's browser...

Full Disclosure

Checking existence of firewalled URLs via javascript's script.onload

April 21^st 2023 at 19:05

Posted by Georgi Guninski on Apr 21

There is minor information disclosure vulnerability similar
to nmap in browser.

It is possible to check the existence of firewalled URL U via
the following javascript in a browser:

<script src="U"
onload="alert('Exists')"
onerror="alert('Does not exist')">

This might have privacy implication on potentially
"semi-blind CSRF" (XXX does this makes sense?).

Works for me in...

Full Disclosure

[CVE-2023-22620] SecurePoint UTM <= 12.2.5 “spcgi.cgi” sessionId Information Disclosure Allowing Device Takeover

April 18^th 2023 at 07:18

Posted by Julien Ahrens (RCE Security) on Apr 18

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: SecurePoint UTM
Vendor URL: https://www.securepoint.de/en/for-companies/firewall-vpn
Type: Exposure of Sensitive Information to an Unauthorized Actor [CWE-200]
Date found: 2023-01-05
Date published: 2023-04-11
CVSSv3 Score: 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
CVE: CVE-2023-22620

2....

Full Disclosure

[CVE-2023-22897] SecurePoint UTM <= 12.2.5 “spcgi.cgi” Remote Memory Contents Information Disclosure

April 18^th 2023 at 07:18

Posted by Julien Ahrens (RCE Security) on Apr 18

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: SecurePoint UTM
Vendor URL: https://www.securepoint.de/en/for-companies/firewall-vpn
Type: Use of Uninitialized Variable [CWE-457]
Date found: 2023-01-05
Date published: 2023-04-12
CVSSv3 Score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVE: CVE-2023-22897

2. CREDITS
==========
This...

Full Disclosure

APPLE-SA-2023-04-07-3 Safari 16.4.1

April 11^th 2023 at 02:23

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-3 Safari 16.4.1

Safari 16.4.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213722.

WebKit
Available for: macOS Big Sur and macOS Monterey
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue
may have been actively exploited.
Description: A use after free issue was addressed...

Full Disclosure

APPLE-SA-2023-04-07-1 iOS 16.4.1 and iPadOS 16.4.1

April 11^th 2023 at 02:23

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-1 iOS 16.4.1 and iPadOS 16.4.1

iOS 16.4.1 and iPadOS 16.4.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213720.

IOSurfaceAccelerator
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air
3rd generation and later, iPad 5th generation and later, and iPad
mini 5th generation and later
Impact: An app may be able to execute arbitrary code...

Full Disclosure

APPLE-SA-2023-04-07-2 macOS Ventura 13.3.1

April 11^th 2023 at 02:23

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-2 macOS Ventura 13.3.1

macOS Ventura 13.3.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213721.

IOSurfaceAccelerator
Available for: macOS Ventura
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

Full Disclosure

APPLE-SA-2023-04-10-3 macOS Big Sur 11.7.6

April 11^th 2023 at 02:23

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-3 macOS Big Sur 11.7.6

macOS Big Sur 11.7.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213725.

IOSurfaceAccelerator
Available for: macOS Big Sur
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

Full Disclosure

APPLE-SA-2023-04-10-1 iOS 15.7.5 and iPadOS 15.7.5

April 11^th 2023 at 02:23

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-1 iOS 15.7.5 and iPadOS 15.7.5

iOS 15.7.5 and iPadOS 15.7.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213723.

IOSurfaceAccelerator
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone
SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod
touch (7th generation)
Impact: An app may be able to execute arbitrary code with...

Full Disclosure

APPLE-SA-2023-04-10-2 macOS Monterey 12.6.5

April 11^th 2023 at 02:23

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-2 macOS Monterey 12.6.5

macOS Monterey 12.6.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213724.

IOSurfaceAccelerator
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

Full Disclosure

FedEx Ship Manager (FSM) v3704 Insecure Use of .NET Remoting

April 4^th 2023 at 18:49

Posted by Harrison Neal on Apr 04

Vulnerable Software Download URL:
https://www.fedex.com/en-us/shipping/ship-manager/software.html#tab-4

FSM 3704 (and some earlier versions) use .NET Remoting in a way that can
lead to unauthenticated remote code execution attacks as SYSTEM. Tools that
can successfully attack affected services are freely available.
Administrators should block or otherwise limit access to TCP ports opened
by services installed by this software wherever possible.

Full Disclosure

RSA NetWitness EDR Agent / Incorrect Access Control - Code Execution / CVE-2022-47529

March 31^st 2023 at 02:29

Posted by hyp3rlinx on Mar 30

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec

[Vendor]
RSA Securitywww.netwitness.com

[Product]
NetWitness Endpoint EDR Agent

The RSA NetWitness detection and response (EDR) endpoint monitors
activity across all your...

Full Disclosure

RSA NetWitness Platform EDR / Incorrect Access Control - Code Execution

March 28^th 2023 at 02:43

Posted by hyp3rlinx on Mar 27

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec

[Vendor]
RSA Security
www.netwitness.com

[Product]
NetWitness Endpoint EDR Agent

The RSA NetWitness detection and response (EDR) endpoint monitors activity across all your...

Full Disclosure

APPLE-SA-2023-03-27-7 watchOS 9.4

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-7 watchOS 9.4

watchOS 9.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213678.

AppleMobileFileIntegrity
Available for: Apple Watch Series 4 and later
Impact: A user may gain access to protected parts of the file system
Description: The issue was addressed with improved checks.
CVE-2023-23527: Mickey Jin (@patch1t)

Calendar
Available for: Apple Watch...

Full Disclosure

APPLE-SA-2023-03-27-4 macOS Monterey 12.6.4

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-4 macOS Monterey 12.6.4

macOS Monterey 12.6.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213677.

Apple Neural Engine
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-23540: Mohamed GHANNAM (@_simo36)...

Full Disclosure

APPLE-SA-2023-03-27-3 macOS Ventura 13.3

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-3 macOS Ventura 13.3

macOS Ventura 13.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213670.

AMD
Available for: macOS Ventura
Impact: An app may be able to cause unexpected system termination or
write kernel memory
Description: A buffer overflow issue was addressed with improved
memory handling.
CVE-2023-27968: ABC Research s.r.o.

Apple Neural Engine...

Full Disclosure

APPLE-SA-2023-03-27-1 iOS 16.4 and iPadOS 16.4

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-1 iOS 16.4 and iPadOS 16.4

iOS 16.4 and iPadOS 16.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213676.

Accessibility
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air
3rd generation and later, iPad 5th generation and later, and iPad
mini 5th generation and later
Impact: An app may be able to access information about a user’s...

Full Disclosure

APPLE-SA-2023-03-27-6 tvOS 16.4

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-6 tvOS 16.4

tvOS 16.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213674.

AppleMobileFileIntegrity
Available for: Apple TV 4K (all models) and Apple TV HD
Impact: A user may gain access to protected parts of the file system
Description: The issue was addressed with improved checks.
CVE-2023-23527: Mickey Jin (@patch1t)

Core Bluetooth
Available for:...

Full Disclosure

APPLE-SA-2023-03-27-2 iOS 15.7.4 and iPadOS 15.7.4

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-2 iOS 15.7.4 and iPadOS 15.7.4

iOS 15.7.4 and iPadOS 15.7.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213673.

Accessibility
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone
SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod
touch (7th generation)
Impact: An app may be able to access information about a...

Full Disclosure

APPLE-SA-2023-03-27-8 Safari 16.4

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-8 Safari 16.4

Safari 16.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213671.

WebKit
Available for: macOS Big Sur and macOS Monterey
Impact: Processing maliciously crafted web content may bypass Same
Origin Policy
Description: This issue was addressed with improved state management.
WebKit Bugzilla: 248615
CVE-2023-27932: an anonymous researcher...

Full Disclosure

APPLE-SA-2023-03-27-9 Studio Display Firmware Update 16.4

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-9 Studio Display Firmware Update 16.4

Studio Display Firmware Update 16.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213672.

Display
Available for: macOS Ventura 13.3 and later
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A memory corruption issue was addressed with improved
state management....

Full Disclosure

APPLE-SA-2023-03-27-5 macOS Big Sur 11.7.5

March 28^th 2023 at 02:43

Posted by Apple Product Security via Fulldisclosure on Mar 27

APPLE-SA-2023-03-27-5 macOS Big Sur 11.7.5

macOS Big Sur 11.7.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213675.

Apple Neural Engine
Available for: macOS Big Sur
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: The issue was addressed with improved memory handling.
CVE-2023-23540: Mohamed GHANNAM (@_simo36)

AppleAVD
Available...

Full Disclosure

Defense in depth -- the Microsoft way (part 84): (no) fun with %COMSPEC%

March 24^th 2023 at 13:17

Posted by Stefan Kanthak on Mar 24

Hi @ll,

the documentation of the builtin START command
<https://technet.microsoft.com/en-us/library/cc770297.aspx>
of Windows NT's command processor CMD.EXE states:

| When you run a command that contains the string "CMD" as the first
| token without an extension or path qualifier, "CMD" is replaced
| with the value of the COMSPEC variable.
| This prevents users from picking up cmd from the current directory....

Full Disclosure

Invitation to the World Cryptologic Competition 2023

March 22^nd 2023 at 05:32

Posted by Competition Administrator on Mar 21

The WCC 2023 is a fully-online and open competition using GitHub.
The language of the competition is English.

The WCC 2023 has a total duration of 295 days, from Sunday January 1st 2023
to Monday October 23rd 2023.
Teams and Judges must complete registration before Wednesday June 1st.

The WCC 2023 has three entry categories:
Category A: Block Ciphers with a 512-bit block, 512-bit key, and 192-bit
nonce
Category B: Digest Functions with a...

Full Disclosure

Re: Microsoft PlayReady security research

March 22^nd 2023 at 05:30

Posted by Adam Gowdiak on Mar 21

Hello,

I feel obliged to provide additional comments to this paragraph as I
start to believe that CANAL+ might not deserve sole blame here...

While Microsoft claims there is absolutely no bug at its end, I
personally start to perceive the company as the one that should be
also blamed to some extent.

Below, I am providing you with the reasons that has lead me to such a
conclusion.

For many months, no response from CANAL+ was taken at my end as...

Full Disclosure

Insecure python cgi documentation and tutorials are vulnerable to XSS.

March 22^nd 2023 at 05:30

Posted by Georgi Guninski on Mar 21

Is there low hanging fruit for the following observation?

The documentation of the python cgi module is vulnerable to XSS
(cross site scripting)

https://docs.python.org/3/library/cgi.html

```
form = cgi.FieldStorage()
print("<p>name:", form["name"].value)
print("<p>addr:", form["addr"].value)
```

First result on google for "tutorial python cgi"
is...

Full Disclosure

Re: Defense in depth -- the Microsoft way (part 83): instead to fix even their most stupid mistaskes, they spill barrels of snakeoil to cover them (or just leave them as-is)

March 22^nd 2023 at 05:29

Posted by Arik Seils on Mar 21

Hi there,

One can use the Metasploit Framework Module post/windows/local/bypassua _fodhelper to achieve this.

Greetings from Germany,

A.Seils

17.03.2023 06:26:56 Stefan Kanthak <stefan.kanthak () nexgo de>:

Full Disclosure

Re: Microsoft PlayReady security research

March 21^st 2023 at 10:11

Posted by Security Explorations on Mar 21

Hello,

I feel obliged to provide additional comments to this paragraph as I
start to believe that CANAL+ might not deserve sole blame here...

While Microsoft claims there is absolutely no bug at its end, I
personally start to perceive the company as the one that should be
also blamed to some extent.

Below, I am providing you with the reasons that has lead me to such a
conclusion.

For many months, no response from CANAL+ was taken at my end as...

Full Disclosure

Defense in depth -- the Microsoft way (part 83): instead to fix even their most stupid mistaskes, they spill barrels of snakeoil to cover them (or just leave them as-is)

March 17^th 2023 at 05:23

Posted by Stefan Kanthak on Mar 16

Hi @ll,

with Windows 2000, Microsoft virtualised the [HKEY_CLASSES_ROOT] registry
branch: what was just an alias for [HKEY_LOCAL_MACHINE\SOFTWARE\Classes]
before became the overlay of [HKEY_LOCAL_MACHINE\SOFTWARE\Classes] and
[HKEY_CURRENT_USER\Software\Classes] with the latter having precedence:
<https://msdn.microsoft.com/en-us/library/ms724498.aspx>

Note: while [HKEY_LOCAL_MACHINE\SOFTWARE\Classes] is writable only by...

Full Disclosure

[CFP] Security BSides Ljubljana 0x7E7 | June 16, 2023

March 17^th 2023 at 05:22

Posted by Andraz Sraka on Mar 16

MMMMMMMMMMMMMMMMNmddmNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMN..-..--+MMNy:...-.-/yNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMy..ymd-.:Mm::-:osyo-..-mMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MM:..---.:dM/..+NNyyMN/..:MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
Mm../dds.-oy.-.dMh--mMds++MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
My:::::/ydMmo..-hMMMmo//omMs/+Mm+++++shNMN+//+//+oMNy+///ohM
MMMs//yMNo+hMh---m:-:hy+sMN..+Mo..os+.-:Ny--ossssdN-.:yyo+mM...

Full Disclosure

Full Disclosure - Fastly

March 12^th 2023 at 03:13

Posted by Andrey Stoykov on Mar 11

Correspondence from Fastly declined to comment regarding new discovered
vulnerabilities within their website.

Poor practices regarding password changes.

1. Reset user password
2. Access link sent
3. Temporary password sent plaintext

// HTTP POST request

POST /user/mwebsec%40gmail.com/password/request_reset HTTP/2
Host: api.fastly.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0)
Gecko/20100101 Firefox/108.0
[...]

[...]...

Full Disclosure

Full Disclosure - Shopify Application

March 12^th 2023 at 03:13

Posted by Andrey Stoykov on Mar 11

Correspondence from Shopify declined to comment regarding new discovered
vulnerabilities within their website.

Although 'frontend' vulnerabilities are considered out of scope,
person/tester foundhimself a beefy bugbounty from the same page that has
been listed below, including similar functionality that has not been tested
yet.

Two emails and several reports, the 'hacker-1' staff reject the bid for
findings.

Online Store...

Full Disclosure

[CVE-2023-25355/25356] No fix available - vulnerabilities in CoreDial sipXcom sipXopenfire

March 7^th 2023 at 02:47

Posted by Systems Research Group via Fulldisclosure on Mar 06

Full Disclosure

SEC Consult SA-20230306-0 :: Multiple Vulnerabilities in Arris DG3450 Cable Gateway

March 7^th 2023 at 02:46

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Mar 06

SEC Consult Vulnerability Lab Security Advisory < 20230306-0 >
=======================================================================
title: Multiple Vulnerabilities
product: Arris DG3450 Cable Gateway
vulnerable version: AR01.02.056.18_041520_711.NCS.10
fixed version: -
CVE number: CVE-2023-27571, CVE-2023-27572
impact: medium
homepage: https://www.commscope.com...

Full Disclosure

OpenBSD overflow

March 7^th 2023 at 02:45

Posted by Erg Noor on Mar 06

Hi,

Fun OpenBSD bug.

ip_dooptions() will allow IPOPT_SSRR with optlen = 2.

save_rte() will set isr_nhops to very large value, which will cause
overflow in next ip_srcroute() call.

More info is here https://github.com/fuzzingrf/openbsd_tcpip_overflow/

-erg

Full Disclosure

SEC Consult SA-20230228-0 :: OS Command Injectionin Barracuda CloudGen WAN

March 3^rd 2023 at 06:18

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Mar 02

SEC Consult Vulnerability Lab Security Advisory < 20230228-0 >
=======================================================================
title: OS Command Injection
product: Barracuda CloudGen WAN
vulnerable version: < v8.* hotfix 1089
fixed version: v8.* with hotfix webui-sdwan-1089-8.3.1-174141891 or above
version 9.0.0 or above
CVE number: CVE-2023-26213...

Full Disclosure

SRP on Windows 11

March 3^rd 2023 at 06:18

Posted by Andy Ful on Mar 02

The correction to:
Full Disclosure: Defense in depth -- the Microsoft way (part 82):
INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2
(seclists.org) <https://seclists.org/fulldisclosure/2023/Feb/13>

The Kanthak correction to restore SRP functionality on Windows 11 ver.
22H2, works only when Smart App Control is OFF. If it is in Evaluate or ON
mode, then the invalid registry values are automatically restored after
restarting...

Full Disclosure

NetBSD overflow

March 3^rd 2023 at 06:17

Posted by Erg Noor on Mar 02

Hi,

Trivial overflow in hfslib_reada_node_offset, while loop has no range
checks.

|size_t hfslib_reada_node_offsets(void* in_bytes, uint16_t*
out_offset_array) { void* ptr; if (in_bytes == NULL || out_offset_array
== NULL) return 0; ptr = in_bytes; out_offset_array--; do {
out_offset_array++; *out_offset_array = be16tohp(&ptr); } while
(*out_offset_array != (uint16_t)14); return ((uint8_t*)ptr -
(uint8_t*)in_bytes); }|

Repro is here...

Full Disclosure

[NetworkSEC NWSSA] CVE-2023-26602: ASUS ASMB8 iKVM RCE and SSH Root Access

February 28^th 2023 at 07:41

Posted by Peter Ohm on Feb 27

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# Exploit Title: ASUS ASMB8 iKVM RCE and SSH Root Access
# Date: 2023-02-16
# Exploit Author: d1g () segfault net for NetworkSEC [NWSSA-002-2023]
# Vendor Homepage: https://servers.asus.com/search?q=ASMB8
# Version/Model: ASMB8 iKVM Firmware <= 1.14.51 (probably others)
# Tested on: Linux AMI2CFDA1C7570E 2.6.28.10-ami...

Full Disclosure

[NetworkSEC NWSSA] CVE-2023-26609: ABUS Security Camera LFI, RCE and SSH Root

February 28^th 2023 at 07:41

Posted by Peter Ohm on Feb 27

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
# Exploit Title: ABUS Security Camera LFI, RCE and SSH Root Access
# Date: 2023-02-16
# Exploit Author: d1g () segfault net for NetworkSEC [NWSSA-001-2023]
# Vendor Homepage: https://www.abus.com
# Version/Model: TVIP 20000-21150 (probably many others)
# Tested on: GM ARM Linux 2.6, Server: Boa/0.94.14rc21
# CVE:...

Full Disclosure

Microsoft Windows Contact File / Remote Code Execution (Resurrected) CVE-2022-44666

February 28^th 2023 at 03:13

Posted by hyp3rlinx on Feb 27

[-] Microsoft Windows Contact file / Remote Code Execution (Resurrected
2022) / CVE-2022-44666

[+] John Page (aka hyp3rlinx)
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec

Back in 2018 I discovered three related Windows remote code execution
vulnerabilities affecting both VCF and Contact files. They were purchased
by Trend Micro Zero Day Initiative (@thezdi) from me and received candidate
identifiers ZDI-CAN-6920 and ZDI-CAN-7591. Microsoft...

Full Disclosure

Defense in depth -- the Microsoft way (part 82): INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2

February 23^rd 2023 at 06:16

Posted by Stefan Kanthak on Feb 22

Hi @ll,

in Windows 11 22H2. some imbeciles from Redmond added the following
(of course WRONG and INVALID) registry entries and keys which they
dare to ship to their billion world-wide users:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp]
"RuleCount"=dword:00000002
"LastWriteTime"=hex(b):01,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Srp\Gp\DLL]

JFTR: the time stamp is 100ns past...

Full Disclosure

Multiple vulnerabilities in Audiocodes Device Manager Express

February 23^rd 2023 at 06:15

Posted by Eric Flokstra on Feb 22

# Product Name: Device Manager Express
# Vendor Homepage: https://www.audiocodes.com
# Software Link:
https://www.audiocodes.com/solutions-products/products/management-products-solutions/device-manager
# Version: <= 7.8.20002.47752
# Tested on: Windows 10 / Server 2019
# Default credentials: admin/admin
# CVE-2022-24627, CVE-2022-24628, CVE-2022-24629, CVE-2022-24630,
CVE-2022-24631, CVE-2022-24632
# Exploit:...

Full Disclosure

Sumo Logic keep api credentials on endpoints

February 23^rd 2023 at 06:15

Posted by dammitjosie--- via Fulldisclosure on Feb 22

security bug:

go sumologic.com (big company, many customer)

make free account

log in account, make access key - help.sumologic.com/docs/manage/security/access-keys/
<http://help.sumologic.com/docs/manage/security/access-keys/>

download collector for windows -
help.sumologic.com/docs/send-data/installed-collectors/collector-installation-reference/download-collector-from-static-url/

<...

Full Disclosure

Remote Code Execution in Kardex MLOG

February 17^th 2023 at 03:35

Posted by Patrick Hener on Feb 16

Remote Code Execution in Kardex MLOG
=======================================================================
Product: Kardex Mlog MCC
Vendor: Kardex Holding AG
Tested Version: 5.7.12+0-a203c2a213-master
Fixed Version: inline patch - no new version number
Vulnerability Type: Improper Control of Generation of Code ("RFI") - CWE-94
CVSSv2 Severity:...

Full Disclosure

CyberDanube Security Research 20230213-0 | Multiple Vulnerabilities in JetWave Series

February 14^th 2023 at 21:43

Posted by Thomas Weber on Feb 14

CyberDanube Security Research 20230213-0
-------------------------------------------------------------------------------
                title| Multiple Vulnerabilities
              product| JetWave4221 HP-E, JetWave 2212G, JetWave
2212X/2212S,
                     | JetWave 2211C, JetWave 2411/2111, JetWave
2411L/2111L,
                     | JetWave 2414/2114, JetWave...

Full Disclosure

SEC Consult SA-20230214-0 :: Multiple XSS Vulnerabilities in B&R Systems Diagnostics Manager

February 14^th 2023 at 21:42

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Feb 14

SEC Consult Vulnerability Lab Security Advisory < 20230214-0 >
=======================================================================
title: Multiple XSS Vulnerabilities
product: B&R Systems Diagnostics Manager
vulnerable version: >=3.00 and <=C4.93
fixed version: >=D4.93
CVE number: CVE-2022-4286
impact: medium
homepage: https://www.br-automation.com...

Full Disclosure

Defense in depth -- the Microsoft way (part 81): enabling UTF-8 support breaks existing code

February 14^th 2023 at 21:42

Posted by Stefan Kanthak on Feb 14

Hi @ll,

almost 4 years ago, with Windows 10 1903, after more than a year
beta-testing in insider previews, Microsoft finally released UTF-8
support for the -A interfaces of the Windows API.

0) <https://docs.microsoft.com/en-us/windows/uwp/design/globalizing/use-utf8-code-page#activeCodePage>

| If the ANSI code page is configured for UTF-8, -A APIs typically
| operate in UTF-8. This model has the benefit of supporting
| existing...

Full Disclosure

APPLE-SA-2023-02-13-1 iOS 16.3.1 and iPadOS 16.3.1

February 14^th 2023 at 21:42

Posted by Apple Product Security via Fulldisclosure on Feb 14

APPLE-SA-2023-02-13-1 iOS 16.3.1 and iPadOS 16.3.1

iOS 16.3.1 and iPadOS 16.3.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213635.

Kernel
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air
3rd generation and later, iPad 5th generation and later, and iPad
mini 5th generation and later
Impact: An app may be able to execute arbitrary code with kernel...

Full Disclosure

APPLE-SA-2023-02-13-2 macOS Ventura 13.2.1

February 14^th 2023 at 21:42

Posted by Apple Product Security via Fulldisclosure on Feb 14

APPLE-SA-2023-02-13-2 macOS Ventura 13.2.1

macOS Ventura 13.2.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213633.

Kernel
Available for: macOS Ventura
Impact: An app may be able to execute arbitrary code with kernel
privileges
Description: A use after free issue was addressed with improved
memory management.
CVE-2023-23514: Xinru Chi of Pangu Lab, Ned Williamson of...

Full Disclosure

APPLE-SA-2023-02-13-3 Safari 16.3.1

February 14^th 2023 at 21:42

Posted by Apple Product Security via Fulldisclosure on Feb 14

APPLE-SA-2023-02-13-3 Safari 16.3.1

Safari 16.3.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213638.

WebKit
Available for: macOS Big Sur and macOS Monterey
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue
may have been actively exploited.
Description: A type confusion issue was addressed...

Full Disclosure

OXAS-ADV-2022-0002: OX App Suite Security Advisory

February 14^th 2023 at 21:41

Posted by Martin Heiland via Fulldisclosure on Feb 14

Dear subscribers,

we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at YesWeHack.

A CSAF representation of this advisory has been published at
https://documentation.open-xchange.com/security/advisories/.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Internal reference:...

Full Disclosure

[CVE-2023-0291] Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion

February 14^th 2023 at 21:40

Posted by Julien Ahrens (RCE Security) on Feb 14

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Quiz And Survey Master
Vendor URL: https://wordpress.org/plugins/quiz-master-next/
Type: Missing Authentication for Critical Function [CWE-306]
Date found: 2023-01-13
Date published: 2023-02-08
CVSSv3 Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVE: CVE-2023-0291

2. CREDITS
==========...

Full Disclosure

[CVE-2023-0292] Quiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media Deletion

February 14^th 2023 at 21:40

Posted by Julien Ahrens (RCE Security) on Feb 14

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Quiz And Survey Master
Vendor URL: https://wordpress.org/plugins/quiz-master-next/
Type: Cross-Site Request Forgery (CSRF) [CWE-352]
Date found: 2023-01-13
Date published: 2023-02-08
CVSSv3 Score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
CVE: CVE-2023-0292

2. CREDITS
==========
This...

Full Disclosure

[CVE-Request] Multiple vulnerabilities in BMC Control-M before 9.0.20.214

February 14^th 2023 at 21:39

Posted by Benjamin Mar-Conrad on Feb 14

Full Disclosure

Trovent Security Advisory 2203-01 / Micro Focus GroupWise transmits session ID in URL

January 31^st 2023 at 07:03

Posted by Stefan Pietsch on Jan 30

# Trovent Security Advisory 2203-01 #
#####################################

Micro Focus GroupWise transmits session ID in URL
#################################################

Overview
########

Advisory ID: TRSA-2203-01
Advisory version: 1.0
Advisory status: Public
Advisory URL: https://trovent.io/security-advisory-2203-01
Affected product: Micro Focus GroupWise
Affected version: prior to 18.4.2
Vendor: Micro Focus, https://www.microfocus.com...

Full Disclosure

[SYSS-2022-047] Razer Synapse - Local Privilege Escalation

January 27^th 2023 at 03:53

Posted by Oliver Schwarz via Fulldisclosure on Jan 26

Advisory ID: SYSS-2022-047
Product: Razer Synapse
Manufacturer: Razer Inc.
Affected Version(s): Versions before 3.7.0830.081906
Tested Version(s): 3.7.0731.072516
Vulnerability Type: Improper Certificate Validation (CWE-295)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2022-08-02
Solution Date: 2022-09-06
Public Disclosure:...