data

Google Data Shines Light On Whether Coronavirus Lockdowns Worldwide Are Working







data

Cisco Warns Of Critical Flaws In Data Center Network Manager





data

Cisco Data Center Network Manager Unauthenticated Remote Code Execution

DCNM exposes a file upload servlet (FileUploadServlet) at /fm/fileUpload. An authenticated user can abuse this servlet to upload a WAR to the Apache Tomcat webapps directory and achieve remote code execution as root. This module exploits two other vulnerabilities, CVE-2019-1619 for authentication bypass on versions 10.4(2) and below, and CVE-2019-1622 (information disclosure) to obtain the correct directory for the WAR file upload. This module was tested on the DCNM Linux virtual appliance 10.4(2), 11.0(1) and 11.1(1), and should work on a few versions below 10.4(2). Only version 11.0(1) requires authentication to exploit (see References to understand why).















data

CentOS-WebPanel.com Control Web Panel (CWP) 0.9.8.851 Arbitrary Database Drop

CentOS-WebPanel.com Control Web Panel (CWP) version 0.9.8.851 suffers from an arbitrary database dropping vulnerability.




data

ManageEngine DataSecurity Plus Authentication Bypass

ManageEngine DataSecurity Plus versions prior to 6.0.1 and ADAudit Plus versions prior to 6.0.3 suffer from an authentication bypass vulnerability.




data

Nissan Car Secretly Shares Driver Data With Websites




data

IBM Data Risk Manager 2.0.3 Default Password

This Metasploit module abuses a known default password in IBM Data Risk Manager. The a3user has the default password idrm and allows an attacker to log in to the virtual appliance via SSH. This can be escalate to full root access, as a3user has sudo access with the default password. At the time of disclosure, this is a 0day. Versions 2.0.3 and below are confirmed to be affected, and the latest 2.0.6 is most likely affected too.







data

vReliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation

This Metasploit module exploits a vulnerability in the rds_page_copy_user function in net/rds/page.c (RDS) in Linux kernel versions 2.6.30 to 2.6.36-rc8 to execute code as root (CVE-2010-3904). This module has been tested successfully on Fedora 13 (i686) kernel version 2.6.33.3-85.fc13.i686.PAE and Ubuntu 10.04 (x86_64) with kernel version 2.6.32-21-generic.








data

Covert Channel And Data Hiding In TCP/IP

Whitepaper called Covert Channel and Data Hiding in TCP/IP.








data

ManageEngine DataSecurity Plus Path Traversal / Code Execution

ManageEngine DataSecurity Plus versions prior to 6.0.1 and ADAudit Plus versions prior to 6.0.3 suffers from a path traversal vulnerability that can lead to remote code execution.




data

Cisco Data Center Network Manager 11.2 Remote Code Execution

Cisco Data Center Network Manager version 11.2 remote code execution exploit.




data

Cisco Data Center Network Manager 11.2.1 SQL Injection

Cisco Data Center Network Manager version 11.2.1 suffers from a remote SQL injection vulnerability.




data

Cisco Data Center Network Manager 11.2.1 Command Injection

Cisco Data Center Network Manager version 11.2.1 remote command injection exploit.







data

Northern Ireland DFP Rapped Over Data Loss