Blog

Website

feeds.feedburner.com · all feeds from this site

Feed URL

https://feeds.feedburner.com/GdsSecurityBlog Copy

Follow Read it in your FeedListing reader

Or add to: Feedly Inoreader Raw feed

Latest posts

• RCE Using Caller ID - Multiple Vulnerabilities in FusionPBX 07 Jun 2019

  Aon’s Cyber Solutions has recently discovered several vulnerabilities in FusionPBX, an open-source VoIP PBX application that runs on top of the FreeSWITCH VoIP switch. These vulnerabilities allow for novel exploitation vectors, including an exploit chain that is triggered by a…

• SSRF and XXE Vulnerabilities in PDFreactor 28 May 2019

  Aon’s Cyber Solutions recently discovered two vulnerabilities in RealObjects PDFreactior prior to version 10.1.10722 in the default configuration. The identified vulnerabilities allow attackers to perform Server-Side Request Forgery (SSRF) and XML External Entity Injection (XXE)…

• Unauthenticated Remote Code Execution in Kentico CMS 15 Apr 2019

  Aon’s Cyber Solutions Security Testing team recently discovered a vulnerability, CVE-2019-10068, in the Kentico CMS platform versions 12.0.14 and earlier. This issue allows for unauthenticated remote code execution through a deserialization vulnerability in the staging service.…

• Remote Code Execution in BlogEngine.NET 28 Mar 2019

  Aon’s Cyber Solutions Security Testing team recently discovered a vulnerability, CVE-2019-6714, in the BlogEngine.NET blogging software platform affecting versions 3.3.6.0 and earlier. This issue allows for remote code execution through a path traversal vulnerability in the file…

• Wowza Streaming Engine Manager Directory Traversal and Local File Inclusion 11 Feb 2019

  HTTP/1.1 200 OK Server: Winstone Servlet Engine v1.0.5 Content-Type: application/octet-stream Content-Disposition: attachement; filename=”shadow.zip” Connection: Close Date: Thu, 17 May 2018 18:11:09 GMT X-Powered-By: Servlet/2.5 (Winstone/1.0.5)

• CUPS Local Privilege Escalation and Sandbox Escapes 11 Jul 2018

  Gotham Digital Science has discovered multiple vulnerabilities in Apple’s CUPS print system affecting macOS 10.13.4 and earlier and multiple Linux distributions. All information in this post has been shared with Apple and other affected vendors prior to publication as part of…

• Breaking Randomness in the Ethereum Universe [part 1] 01 Jun 2018

  It is widely acknowledged that generating secure random numbers on the Ethereum blockchain is difficult due to its deterministic nature. Each time a smart contract’s function is called inside of a transaction, it must be replayed and verified by the rest of the network. This is…

• Jolokia Vulnerabilities - RCE & XSS 18 Apr 2018

  Recently, during a client engagement, Gotham Digital Science found a couple of zero-day vulnerabilities in the Jolokia service. Jolokia is an open source product that provides an HTTP API interface for JMX (Java Management Extensions) technology. It contains an API we can use…

• Skybox Vulnerabilities 04 Jan 2018

  Overview Gotham Digital Science (GDS) recently discovered multiple vulnerabilities that affect the Skybox Manager Client Application and the Skybox Server. These consist of user privilege elevation, arbitrary file upload, password hash disclosure and user enumeration. The…

• Remote Code Execution in BlackBerry Workspaces Server 16 Oct 2017

  Overview Gotham Digital Science (GDS) has discovered a vulnerability affecting BlackBerry Workspaces Server (formerly WatchDox). Prior to being patched, it was possible to remotely execute arbitrary code by exploiting insecure file upload functionality as an unauthenticated…

Report this feed