Cisco StarOS Command Injection Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-cmdinj-759mNT4n?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20StarOS%20Command%20Injection%20Vulnerability&vs_k=1
A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device.
This vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the root user. To exploit this vulnerability, an attacker would need to have valid administrative credentials on an affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-cmdinj-759mNT4n
Security Impact Rating: Medium
CVE: CVE-2022-20665
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-cmdinj-759mNT4n?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20StarOS%20Command%20Injection%20Vulnerability&vs_k=1
A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device.
This vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the root user. To exploit this vulnerability, an attacker would need to have valid administrative credentials on an affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-staros-cmdinj-759mNT4n
Security Impact Rating: Medium
CVE: CVE-2022-20665
Cisco
Cisco Security Advisory: Cisco StarOS Command Injection Vulnerability
A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device.
This vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability…
This vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability…
[webapps] Xerte 3.10.3 - Directory Traversal (Authenticated)
Xerte 3.10.3 - Directory Traversal (Authenticated)
https://www.exploit-db.com/exploits/50794
Xerte 3.10.3 - Directory Traversal (Authenticated)
https://www.exploit-db.com/exploits/50794
Exploit Database
Xerte 3.10.3 - Directory Traversal (Authenticated)
Xerte 3.10.3 - Directory Traversal (Authenticated). CVE-2021-44665 . webapps exploit for PHP platform
El diccionario de extenciones viene incluido en Kali pero en parrot OS no, así que por aquí lo dejo.
https://github.com/Anonimo501/raft-small-extensions-lowercase
https://github.com/Anonimo501/raft-small-extensions-lowercase
GitHub
GitHub - Anonimo501/raft-small-extensions-lowercase
Contribute to Anonimo501/raft-small-extensions-lowercase development by creating an account on GitHub.
Remote code execution vulnerability uncovered in Hashnode blogging platform.
A local file coding error could be exploited to trigger RCE
https://portswigger.net/daily-swig/remote-code-execution-vulnerability-uncovered-in-hashnode-blogging-platform
A local file coding error could be exploited to trigger RCE
https://portswigger.net/daily-swig/remote-code-execution-vulnerability-uncovered-in-hashnode-blogging-platform
The Daily Swig | Cybersecurity news and views
Remote code execution vulnerability uncovered in Hashnode blogging platform
A local file coding error could be exploited to trigger RCE
Microsoft toma medidas frente a los ciberataques de Rusia
https://unaaldia.hispasec.com/2022/03/microsoft-toma-medidas-frente-a-los-ciberataques-de-rusia.html
https://unaaldia.hispasec.com/2022/03/microsoft-toma-medidas-frente-a-los-ciberataques-de-rusia.html
Una al Día
Microsoft toma medidas frente a los ciberataques de Rusia
Microsoft aclara que actuará ante cuatro diferentes frentes en los que se compromete a ayudar a Ucrania frente a Rusia.
Espero OS guste el vídeo sobre el script de hydra que se realizó semanas atrás, lo comparto por qué lo habían pedido.
Saludos y no olviden compartir para llegar a más personas, gracias. 👌👌
https://youtu.be/PgzBmAEaVHE
Saludos y no olviden compartir para llegar a más personas, gracias. 👌👌
https://youtu.be/PgzBmAEaVHE
YouTube
Hydra Brute Force
Hola Amigos de youtube.
El dia de hoy os traigo un video usando el script que realice usando hydra o mejor dicho para facilitar el uso de hydra espero les guste, lo disfruten y lo compartan.
un saludo.
Github - Herramienta:
https://github.com/Anonimo501/hydra_brute…
El dia de hoy os traigo un video usando el script que realice usando hydra o mejor dicho para facilitar el uso de hydra espero les guste, lo disfruten y lo compartan.
un saludo.
Github - Herramienta:
https://github.com/Anonimo501/hydra_brute…
TODO SOBRE ETERNALBLUE.pdf
444.1 KB
Os vuelvo a enviar el PDF ya que he agregado un par de cosas.
Top10 de ataques al Directorio Activo
https://www.hackplayers.com/2022/03/top10-de-ataques-al-directorio-activo.html
https://www.hackplayers.com/2022/03/top10-de-ataques-al-directorio-activo.html
Hackplayers
Top10 de ataques al Directorio Activo
El pentesting del Directorio Activo es una mina de oro para un red teamer ya que es un sistema crítico en la mayoría de las organizaciones. ...
Comunidad Pen7esting
Top10 de ataques al Directorio Activo https://www.hackplayers.com/2022/03/top10-de-ataques-al-directorio-activo.html
No olvidéis que he hecho creo que 4 scripts para este tema de Active Directory, si alguien no los ha visto y OS interesa, díganme y los comparto de nuevo.
Cómo crear un bug de "Buffer Overflow" para crear su exploit y aprender
http://www.elladodelmal.com/2022/03/como-crear-un-bug-de-buffer-overflow.html
http://www.elladodelmal.com/2022/03/como-crear-un-bug-de-buffer-overflow.html
Elladodelmal
Cómo crear un bug de "Buffer Overflow" para crear su exploit y aprender
Blog personal de Chema Alonso (CDO Telefónica, 0xWord, MyPublicInbox, Singularity Hackers) sobre seguridad, hacking, hackers y Cálico Electrónico.
TCP Middlebox Reflection: nuevo tipo de ataque DDoS
https://blog.segu-info.com.ar/2022/03/tcp-middlebox-reflection-nuevo-tipo-de.html
https://blog.segu-info.com.ar/2022/03/tcp-middlebox-reflection-nuevo-tipo-de.html
📃 OFFTOPIC "'Duda de toda la información en Telegram': la app de mensajería, en el punto de mira en plena guerra con Ucrania" https://www.genbeta.com/actualidad/duda-toda-informacion-telegram-app-mensajeria-rusa-punto-mira-plena-guerra-ucrania
Genbeta
"Duda de toda la información en Telegram": la app de mensajería, en el punto de mira en plena guerra con Ucrania
Hace un año, Telegram vivió un gran auge. No solo porque la aplicación de mensajería instantánea suela ir por delante de WhatsApp a la hora de ofrecer muchas...
Forwarded from REDSEG | Noticias
This media is not supported in your browser
VIEW IN TELEGRAM
LOS RIESGOS DE CARGAR UN VEHÍCULO ELÉCTRICO AL INTERIOR DE UN DOMICILIO
Suscríbase @redseg
🌐 REDSEG | Noticias
Noticias Destacadas del Sector Seguridad y Delincuencia de Alta Tecnología
Suscríbase @redseg
🌐 REDSEG | Noticias
Noticias Destacadas del Sector Seguridad y Delincuencia de Alta Tecnología