Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

Booking Ultra Pro offers a great suite of features that will help you manage your online appointments 24/7 whether you are a large educational institution scheduling thousands of students or a massage therapists with a part-time practice.

Booking Ultra Pro is a WordPress appointment scheduling plugin that allows your customers to book appointments for your services directly from your website giving your customers a seamless booking experience. The unique 4 steps booking process will help you to attract new customers and generate repeat business from existing ones. All customer details are stored so you can run promotions and market directly to them.

Check out the Standard Appointments Form for more information!

Check out the Staff List Page.  
Check out the Minimal Booking Form Layout.  
Check out the Shopping Cart.

This Appointments Plugin for WordPress is an inspired scheduling plugin that puts the power of booking into your clients’ hands while giving yourself and your team individual accounts to manage your own services, calendars, rates, and much more. Whether your business is already booming or you’re trying to grow, this WordPress plugin can help you. With a variety of packages offered to fit your business’s needs, Booking Ultra Pro eliminates the hassle of personally scheduling clients and increases customer satisfaction by offering 24/7 online appointment booking right at their fingertips.

This plugin helps you to manage appointments by giving your staff members their own profile and access without giving them access to your WordPress Dashboard. This simplifies the appointment process and presents a good first impression to your clients. From the Staff Backend and Profile feature, your staff is able to manage breaks, holidays, schedules, their services, appointments, rates, public profile, and even the ability to connect to Google calendar. The best part? Booking Ultra Pro is easy to use and CUSTOMIZABLE, giving your employees supervised freedom. Customize your text and color, booking form layouts, hide or add staff, manage multiple locations, and your shopping cart!

In addition to the Staffing Backend and Profile, a variety of add-ons such as group booking functions, mobile payment options for clients, appointment notes, and much more are available to fit your needs. Plus, a clean, minimal theme will greet your customer’s and provide them with a functional, maintained environment to complete their bookings. They will also have the ability to use the shopping cart feature to purchase multiple services at once, making it just that much easier to increase business.

**So, what makes Booking Ultra Pro the superior WordPress plugin?**

Aside from a time and money saving service, Booking Ultra Pro offers you full support for any of your technical inquiries via our email service. This makes it easy for you to contact our team at any time. Plus, regular updates are offered. With customizable features and colors that are adaptable to any WordPress theme and optional add-ons for all your needs, we offer a product that can’t be beat. We strive to maintain a high level of customer satisfaction.

Plus, the Booking Ultra Pro plugin can be used for any and every type of services. Are you in big business? Maybe a lawyer or stock broker, Booking Ultra Pro is for you! Oh, you’re a doctor? That’s wonderful, and Booking Ultra Pro is for you! You own a Beauty Salon and want to make booking easier for your clients? BOOKING ULTRA PRO IS FOR YOU! Our packages give everyone just what they need.

Check out the demo site for more information!

**Documentation**

Read the getting started documentation after you install the plugin to get started.

**Self Service Bookings**

Allow customers to view availability and book directly from your own website.

**Instant Payment Processing**

Easily accept online bookings and credit card payments for your bookings. You can use either PayPal or Stripe to process your payments.

**Automate Billing & Invoices**

Instantly send customers customizable receipts and booking invoices.

**Key Features**

*   PayPal Integration
*   Client Online Appointment
*   Admin Online Appointment
*   Appointment Payments
*   Reschedule Appointments
*   Custom Fields
*   **Customizable Emails**
*   Company Working Hours & Days
*   Staff Working Hours & Days
*   Time Slots
*   Padding Time (after and/or before)
*   Unlimited Services
*   Admin Calendar
*   You may also check and compare all the features

**Reasons to upgrade?**

*   Staff & Client Account With Front-End Profile
*   **Google Calendar** Integration
*   **Powerful** Booking Form Customizer
*   Shopping Cart
*   **Stripe** Integration
*   Advanced Admin Booking Panel
*   **Unlimited** Providers / Staff Members
*   Appointment Notes
*   **Flexible Pricing** – Example: First person $100, second person $85, third person $60
*   Appointment Payments
*   Multiple Appointment Forms
*   Terms & Conditions
*   MailChimp
*   **AWeber**
*   SMTP Email Sending
*   Mandrill Email
*   **Multiple Locations**. Yes, you can manage appointments for example from Salon 1, Salon 2 etc etc.
*   **Group Bookings**. Allow clients to book services for several persons at once.

**Languages**

*   Italian
*   German. Thanks to Michael Stark
*   French

**🌐Our Plugins**

If you like this plugin, consider exploring our other plugins:

⏱️ **Quiz and Survey Master** – Best WordPress Quiz Plugin to create engaging quizzes, surveys, & exams using WordPress and convert your website into a lead generating machine.

☰ **Responsive Menu** – Best WordPress Menu Builder Plugin to create awesome and interactive mobile & desktop menus for WordPress websites.

📙 **Projectopia** – Project Management & Invoicing plugin for WordPress. Generate invoices, send quotes, generate leads, manage clients, provide support – all inside your WordPress website.

⚡ **InstaWP** – Launch a quick WordPress site with this sandbox service. Create New WordPress instance within a second.

🔒 **Hide My WP** – Hide your WordPress from bots, attackers & spammers. Hides all the known URLs, paths, plugins, themes which can reveal that you are using WP, also comes with an in-built firewall & trust network.

Ownership of this plugin has changed from UsersUltra to ExpressTech on 15th Nov 2021

1.  Upload booking-ultra-pro to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress

**Is there an online documentation?**

Yes, http://doc.bookingultrapro.com/

**Is the Staff Member allowed to manage their own appointments?**

Yes, check this link Staff & Client Account with Front-End Profile

**Do you offer free support?**

Yes, https://bookingultrapro.com/contact.php

**Why I’m not Getting Emails from Your WordPress Site?**

Please check this link http://doc.bookingultrapro.com/wordpress-is-not-sending-emails-issue/

**How To Allow Clients to Purchase Multiple Services on the Same Session?**

This feature is available only on premium versions. It allows your clients to purchase multiple services from either the same or different providers on one session. They can pay for all the services in bulk. The Booking Ultra Pro Shopping Cart is great for gyms and spa, for example the client can purchase a yoga session for the next four weeks in different time and different providers.

Please check this link http://doc.bookingultrapro.com/how-to-activate-the-shopping-cart-feature/

**Do you offer a PRO version?**

Yes, https://bookingultrapro.com/compare-packages.html

Once configured, it works pretty slick! We bought it but also got a refund after the register codes didn't take and had to track down the owners to get money back. This really could have been a great plugin. we are still using it, but manually copy and pasting to google calendar.. until we find something as easy to use and has all the options.

From their email to us: Note: In the new management, Ultimate license is valid for 1 year (before it was life time). This is done to make sure the business continue to exist and we provide continous improvements. With that kind of support, how long do they really expect to exist?

I had a problem with the plugin and got direct support. It was solved in about 10 minutes. So the support is great.

As a free plug-in, this is great. As a paid plug-in, not sure. I decided that I wanted the advanced functionality and bought a lifetime license. Right off the bat, I had a question and submitted a support ticket. It has been two weeks and they have not even marked the ticket as read. I tried finding another way to contact the support person/team, but the only way is a ticket (and the ticket is not answered). As a free plug-in, this is fine, as a premium plug-in, just be sure you won't have any questions. I don't even see a way to refund this plug-in within the refundable window without being able to talk to someone. Perhaps my problem/question is really easy to answer, but I don't know because of no response. Pro tip to all, don't buy any plug-in without ample contact methods available. -- Update Jan 2022. So, I never got any response from my support questions 6 months into having paid for the plug-in, but I did get an email from support because they were changing things. Apparently, I bought a LIFETIME license and they will only honor the LIFETIME license for 1 year. I paid excess money for a LIFETIME license, yet I am only getting a year. It would have more financial sense to have me only pay the 1 year fee. They totally just pocketed the extra money. I do not trust these people; I do no recommend you do either. It is not a safe idea to build your appointment based website off of a company that will not stick to it's word.

I just purchased the unlimited license for this plugin to use on my clients' websites and I have found it to be a great plugin. When I've contacted support, I got a response right away even before purchasing. The documentation is thorough - I was experiencing a display issue, but I found the solution in their documentation and it was super easy to fix. The plugin has a lot of features, and it has a nice front-end appearance that makes it easy for people to book appointments. After looking at a lot of the other options for booking appointments, this I felt was the best value in terms of cost and features. I seriously don't get why it has so many bad reviews, it has worked fine in my initial tests with the free version, and the paid version I've found to be working so far without any issues.

As many people have stated before, there is no support whatsoever for this plugin. It has a few bugs. There is no way to solve them without the support. I am sorry I have to give a 1 star but honestly it's been more than 2 months since my tickets have been submitted but still no answers. It's money poorly spent.

Read all 230 reviews

“Booking Ultra Pro Appointments Booking Calendar Plugin” is open source software. The following people have contributed to this plugin.

Contributors

*    ExpressTech Systems

**1.1.4 (08-09-2022)**

*   Improvement – Sendinblue Integration
*   Improvement – Improve Documentation
*   Fix – Resove Error \[bup\_staff\_list\]

**1.0.93 (09-20-2021)**

*   Improvement – We have implemented some tweaks on teh coding.
*   Fix – Compatibility issues with thirparty themes.

**1.0.92 (08-09-2021)**

*   Improvement – Updates for WP 5.8

**1.0.91 (06-22-2021)**

*   Fix – Google Calendar Update.
*   Improvement – Licencing Issue.

**1.0.90 (04-22-2021)**

*   Fix – Deleting Staff Members Issue.

**1.0.89 (04-20-2021)**

*   Fix – Deleting Category Issue.
*   Fix – Deleting Subcategory.
*   Fix – Editing User.
*   Fix – Deleting User.
*   Improvement – Improvements for WP Version 5.7.

**1.0.88 (02-07-2021)**

*   Improvement – Month View Improvement.
*   Improvement – Filter by Location.
*   Improvement – Coding Improvement.

**1.0.87 (01-29-2021)**

*   Improvement – Main Calendar on Admin Improved. Month View Issue.
*   Improvement – Filters issue.

**1.0.86 (01-08-2021)**

*   Improvement – Improvement on coding.
*   Improvement – Implement of new Calendar on Main Page at Admin Dashboard
*   Improvement – New Filters on Admin Dashboard

**1.0.85 (12-11-2020)**

*   Improvement – Localization, the plugin was not prepared for localization. Now, with the major update you will be able to translate the plugin online, right here https://translate.wordpress.org/projects/wp-plugins/booking-ultra-pro/. We had to change the textdomain, now it’s booking-ultra-pro. The translation files are in the languages folder, the prefix of the files MO and PO had changed to “booking-ultra-pro-“. This is a major change that might cause some issues with your current translations, however.. this can be resolved quikcly. Just make sure that your translation file has the mentioned prefix.
*   Improvement – class-phpmailer.php is deprecated since version 5.5.0! We have updated the coding.

**1.0.84 (10-07-2020)**

*   Improvement – PayPal IPN Update, please update ASAP

**1.0.83 (09-29-2020)**

*   Improvement – Important Updates PayPal payments issue. Update ASAP

**1.0.82 (09-28-2020)**

*   Improvement – Important Updates for new Version 5.5. Update ASAP
*   Improvement – Tweak on Staff Settings on the Admin section.

**1.0.81 (09-24-2020)**

*   Improvement – Important Updates for new Version 5.0. Update ASAP

**1.0.80 (06-24-2020)**

*   Improvement – Compatibily issues with new version of WP
*   Improvement – Code Improvement
*   Improvement – Improvement with new WP Editor

**1.0.79 (11-10-2019)**

*   Improvement – Compatibily issues with WP 5.3

**1.0.78 (04-23-2019)**

*   Improvement – Issue with Start time dropbox fixed.
*   New Feature – Private Services available only for admin.

**1.0.77 (01-19-2019)**

*   Improvement – WordPress 5.0 tweaks.

**1.0.76 (11-20-2018)**

*   Improvement – Important update on Google Calendar Feature. Full phone number with country prefix is displayed now.

**1.0.75 (11-06-2018)**

*   Improvement – New Module to clean up the database with inconsistent appointment details has been implemented.
*   Improvement – AWeber API integration update. Now. APP ID is not required anymore.
*   New Feature – **Personal, Professional & Ultimate versions only**. Option to change the background color of the user’s profile has been implemented on the staff tab.

**1.0.74 (09-22-2018)**

*   Improvement – CSS improvements.
*   Improvement – Issue with pending orders.

**1.0.73 (09-14-2018)**

*   Improvement – CSS improvements.
*   Improvement – Issue with pending orders.

**1.0.72 (09-09-2018)**

*   Improvement – SMS Feature improved. Now, the option to auto-detect the visitor’s location is optional. You can activate or deactivate the phone number prefix feature on BUP Settings.
*   Improvement – CSS styles improvement.
*   Improvement – Minor fixes issue.
*   Improvement – Authorize API update.

**1.0.71 (06-26-2018)**

*   Improvement – CSS styles conflict with third-party plugins. We’ve improved the checkout process.
*   Improvement – International cel number issue. Now, it’s displayed in the Google Calendar.

**1.0.70 (04-10-2018)**

*   New Feature – **Personal, Professional & Ultimate versions only**. Option to change more labels on the customizer.
*   New Feature – **Personal, Professional & Ultimate versions only**. SMS Reminders.
*   New Feature – **Personal, Professional & Ultimate versions only**. Change the Background color of the staff list. Check the tutorial http://doc.bookingultrapro.com/how-to-change-the-default-background-color-of-the-staff-list/
*   Improvement – CSS styles
*   Improvement – Date Picker JS conflict on custom fields
*   Improvement – Setting to remove the “Last name” from the booking form at the step 3.
*   Bug Fix – Issue with “1 time slot” translation.

**1.0.69 (10-24-2017)**

*   Improvement – IMPORTANT. Update the pluign ASAP, there was an issue with the cancellation link sending many emails. You have to update the plugin ASAP. We’re sorry about the two consecutive versions, we just try to offer a fast service when an issue is confirmed. Thank you for your understanding.

CVE-2021-36855: Booking Ultra Pro Appointments Booking Calendar Plugin

New web targets for the discerning hacker

New web targets for the discerning hacker

This month’s big news was the Uber hack that saw the breach of the ride-sharing app firm’s internal networks, which appeared to have been carried out via a social engineering attack targeting an employee.

The attacker also gained access to an employee’s HackerOne account before commenting on multiple tickets, implying that they had accessed highly sensitive bug bounty reports that could reveal security vulnerabilities in Uber products and infrastructure.

A 17-year-old in the UK has been arrested in connection with the breach, the City of London Police confirmed.

This incident wasn’t Uber’s only embarrassment this month, as its former security head Joe Sullivan stood trial in the US.

Former Uber engineers testified about their concerns over Sullivan’s decision to treat a 2016 hack as a white hat bounty and pay the hackers $100,000 – thus avoiding scrutiny from the Federal Trade Commission.

In bug bounty news, Immunefi says it has paid out $60 million in bounties and helped to avoid $25 billion worth of losses from web3 hacks averted.

The company connects web3 projects that need their code checked and secured with whitehat hackers, offering rewards that can reach as much as $10 million.

Meanwhile, NFT marketplace OpenSea says it has paid out $200,000 to two ethical hackers for finding vulnerabilities, at least one of which was rated critical. The details of the flaws weren’t revealed, but the company says it has moved fast to fix them.

Finally, bounty hunter Sam Curry of Yuga Labs was baffled to receive a $250,000 bounty from Google this month. The only problem? He hadn't submitted any bug report.

According to a company spokesperson – and no doubt disappointingly for Curry – the payment was made in error, and Google planned to ask for it back.

And finally, a survey conducted by SANS Institute and cybersecurity firm Bishop Fox found that the typical ethical hacker can uncover a vulnerability that offers a route beyond the network perimeter in less than 10 hours.

Moreover, 58% can hack into an environment in under five hours once a security flaw has been identified.

**The latest bug bounty programs for October 2022**

The past month saw the arrival of several new bug bounty programs. Here’s a list of the latest entries:

**ALSCO**

**Program provider:  
**HackerOne

**Program type:  
**Public

**Max reward:  
**$1,500

**Outline:  
**Network security provider ALSCO is asking ethical hackers to look for vulnerabilities in its domain.

**Notes:  
**All rewards are based on the CVSS standard. However, ALSCO says that these are general guidelines and payouts are decided at its discretion.

Check out the ALSCO bug bounty page for more details

**Aptos Petra Wallet**

**Program provider:  
**Immunefi

**Program type:  
**Public

**Max reward:  
**$100,000

**Outline:  
**Aptos Petra Wallet is offering a bumper bounty of $100,000 for the most critical vulnerabilities in its websites and applications.

**Notes:  
**It’s worth checking out the list of top targets on the bug bounty page that could earn the hunter the top prize.

Check out the Aptos Petra Wallet’s bug bounty page for more details

**Bing Xchange**

**Program provider:  
**HackenProof

**Program type:  
**Public

**Max reward:  
**$4,000

**Outline:  
**Bing Xchange, a crypto social trading exchange that offers spot, derivatives, and copy trading services to more than 100 countries worldwide, is asking for vulnerability reports on two domains, two apps, and its web API.

**Notes:  
**There is an extensive list of out-of-scope targets, so these should be consulted before trying your hand at any targets.

Check out Bing Xchange’s bug bounty page for more details

**Caisse d'Epargne Normandie**

**Program provider:  
**YesWeHack

**Program type:  
**Public

**Max reward:  
**€2,000

**Outline:  
**The European bank has a number of web applications and APIs to target, and is offering up to €2,000 for the most critical bugs.

**Notes:  
**The bank has noted that any issue in Yousign or mangopay is not in scope, and therefore should not be targeted.

Check out the Caisse d'Epargne Normandie bug bounty page for more details

**LinkTree**

**Program provider:  
**HackerOne

**Program type:  
**Public

**Max reward:  
**$6,000

**Outline:  
**Social media link sharing tool LinkTree is opening multiple domains and two of its mobile apps to bug bounty hunters looking for security flaws.

**Notes:  
**There are 14 different domains to target and two mobile apps, offering plenty of chances to partake.

Check out the LinkTree bug bounty page for more details

**MongoDB**

**Program provider:  
**HackerOne

**Program type:  
**Public

**Max reward:  
**$5,000

**Outline:  
**MongoDB is asking for reports on security vulnerabilities in two of its domains and its GitHub repositories.

**Notes:  
**There are detailed instructions for bug bounty hunters on how to submit reports, so make sure to read these beforehand.

Check out the MongoDB bug bounty page for more details

**Poloniex**

**Program provider:  
**HackerOne

Program type: Public

**Max reward:  
**$5,000

**Outline:  
**Cryptocurrency exchange Poloniex is asking researchers to look for issues in five of its web domains.

**Notes:  
**The most critical bugs can potentially net bug bounty hunters £5,000.

Check out the Poloniex bug bounty page for more details

**Stader for NEAR**

**Program provider:  
**Immunefi

**Program type:  
**Public

**Max reward:  
**$1 million

**Outline:  
**Ethical hackers are being offered the chance to bag an eye-watering one million dollars for vulnerabilities in Stader, a “non-custodial smart contract-based staking platform that helps you conveniently discover and access staking solutions”.

**Notes:  
**Bug severities – and therefore payouts – are classified according to Immunefi’s own scoring system.

Check out the Stader for NEAR bug bounty page for more details

Curated by Jessica Haworth. Additional reporting by Emma Woollacott.

PREVIOUS EDITION Bug Bounty Radar // The latest bug bounty programs for September 2022

Bug Bounty Radar // The latest bug bounty programs for October 2022

Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.

Spending each day immersed in penetration tests and research into the latest threats, our SpiderLabs® experts occasionally discover new vulnerabilities as a part of their work. When that happens, we follow our established disclosure policy which results in published advisories such as these.

Learn more about our disclosure policy _chevron\_right_

**Latest Advisory**

*   **TWSL2022-003****Vulnerabilities in Canon Medical Vitrea View**
    
    **Sep 29, 2022** - Vitrea View is a tool used for viewing medical images and makes use of the DICOM standard.
    
    Read | Download
    

**Advisory Archive**

Advisory

Title

Date

TWSL2022-002

Multiple Vulnerabilities in Oracle Communications Session Border Controller (SBC)

Aug 23, 2022

Read | Download

TWSL2022-001

Authentication Bypass by Capture-replay in DingTian 2 Channel Relay Board/Relay Card

Jul 12, 2022

Read | Download

TWSL2021-019

Privilege Escalation in CrypKey License Software Licensing System

Nov 04, 2021

Read | Download

TWSL2021-018

Authenticated Stored XSS in WordPress Plugin Age Gate

Oct 06, 2021

Read | Download

TWSL2021-017

Multiple Authenticated Stored XSS in WordPress Plugin Inline Related Posts

Oct 06, 2021

Read | Download

TWSL2021-016

Stored XSS in WordPress Plugin Timetable and Event Schedule by MotoPress

Aug 31, 2021

Read | Download

TWSL2021-015

CSRF Vulnerability in WordPress Plugin Comment Link Remove and Other Comment Tools

Aug 20, 2021

Read | Download

TWSL2021-014

Authenticated SQL Injection in WordPress Plugin WP Simple Booking Calendar

Aug 06, 2021

Read | Download

TWSL2021-013

Authenticated SQL Injection in WordPress Plugin Stop Bad Bots

Aug 06, 2021

Read | Download

TWSL2021-012

Vulnerabilities in WordPress Plugin Membership & Content Restriction - Paid Member Subscriptions

Aug 06, 2021

Read | Download

TWSL2021-011

Privacy Issues in Telegram Self-Destruct Feature on macOS

Aug 05, 2021

Read | Download

TWSL2021-010

Remote File Access Vulnerability in ON24 ScreenShare Plugin for macOS

Jul 21, 2021

Read | Download

TWSL2021-009

Persistent Cross-Site Scripting in SolarWinds Serv-U FTP Server

Jul 06, 2021

Read | Download

TWSL2021-008

Code Execution Vulnerability in Huawei Mobile Broadband HL Service

Jun 02, 2021

Read | Download

TWSL2021-007

Multiple Vulnerabilities in AURALL REC MONITOR

Apr 22, 2021

Read | Download

TWSL2021-006

SQLi in WordPress Plugin Simple Membership

Apr 05, 2021

Read | Download

TWSL2021-005

Privilege Escalation Vulnerability in Umbraco

Apr 01, 2021

Read | Download

TWSL2021-004

Stored Authenticated XSS in WordPress Plugin Virtual Robots.txt

Mar 31, 2021

Read | Download

TWSL2021-003

Incorrect SSLv2 rollback protection Vulnerability in OpenSSL

Feb 18, 2021

Read | Download

TWSL2021-002

Weak ACLs Vulnerability in SolarWinds Serv-U FTP Server 15.2.1 on Windows

Feb 03, 2021

Read | Download

TWSL2021-001

Multiple Vulnerabilities in SolarWinds Orion

Feb 03, 2021

Read | Download

TWSL2020-011

Multiple Vulnerabilities in D-Link DSL-2888A

Dec 17, 2020

Read | Download

TWSL2020-010

Multiple Vulnerabilities in Magic Home Pro Mobile Application

Dec 15, 2020

Read | Download

TWSL2020-009

Multiple Cleartext Protocol Vulnerabilities in WinZip

Dec 10, 2020

Read | Download

TWSL2020-008

Lack of Access Control in GO SMS Pro

Nov 19, 2020

Read | Download

TWSL2020-007

Multiple Vulnerabilities in Modicon M221 controllers and EcoStruxure Machine Expert - Basic Programming Software

Nov 12, 2020

Read | Download

TWSL2020-006

Multiple Vulnerabilities in SAP Adaptive Server Enterprise

Sep 24, 2020

Read | Download

TWSL2020-005

Information Disclosure and Denial of Service Vulnerability in IBM Db2

Aug 20, 2020

Read | Download

TWSL2020-004

Multiple Vulnerabilities in ASUS RT-AC1900P router

Jul 23, 2020

Read | Download

TWSL2020-003

Memory information leakage vulnerability in Cisco Webex Meetings Windows Client

Jun 18, 2020

Read | Download

TWSL2020-002

Multiple Vulnerabilities in SAP Adaptive Server Enterprise

Jun 02, 2020

Read | Download

TWSL2020-001

Multiple Vulnerabilities in Schneider Electric Products

May 07, 2020

Read | Download

TWSL2019-010

Multiple Vulnerabilities in SatLink VSAT Modem Units (vmu)

Nov 21, 2019

Read | Download

TWSL2019-009

Insufficiently Protected Credentials in Shelter Manager ASM 2 Series

Oct 25, 2019

Read | Download

TWSL2019-008

Vulnerabilities in D-Link Products

Sep 10, 2019

Read | Download

TWSL2019-007

Vulnerabilities in Comba Products

Sep 10, 2019

Read | Download

TWSL2019-006

Multiple Vulnerabilities in SanDisk SSD Dashboard

Jul 31, 2019

Read | Download

TWSL2019-005

Hardcoded credentials in Uniguest Kiosks

Jul 11, 2019

Read | Download

TWSL2019-004

Expression Injection Vulnerability in Qlik Products

Jun 04, 2019

Read | Download

TWSL2019-003

Multiple Vulnerabilities in Grandstream Products

Mar 21, 2019

Read | Download

TWSL2019-002

Vulnerabilities in SolarWinds Database Performance Analyzer

Mar 21, 2019

Read | Download

TWSL2019-001

OS Command Injection Vulnerabilities in LifeSize Products

Feb 07, 2019

Read | Download

TWSL2018-012

Kernel Buffer Overflow in IBM Trusteer Rapport

Dec 20, 2018

Read | Download

TWSL2018-011

Use after free vulnerability in QFX Software KeyScrambler

Oct 02, 2018

Read | Download

TWSL2018-010

Credential Leak Flaws in Windows PureVPN Client

Sep 27, 2018

Read | Download

TWSL2018-009

CVE-2018-16962: Webroot SecureAnywhere macOS Kernel Level Memory Corruption

Sep 13, 2018

Read | Download

TWSL2018-008

CVE-2018-8006 - Cross-Site Scripting (XSS) Vulnerability in Apache ActiveMQ

Aug 24, 2018

Read | Download

TWSL2018-007

CVE-2018-2892 - Kernel Level Privilege Escalation in Oracle Solaris

Jul 24, 2018

Read | Download

TWSL2018-006

Unpatched Remote Code Execution in Reprise License Manager

Jul 18, 2018

Read | Download

TWSL2018-005

Vulnerability in WD My Cloud personal cloud storage

Oct 29, 2018

Read | Download

TWSL2018-004

Vulnerabilities in NETGEAR Nighthawk X4S router (R7800)

Feb 07, 2018

Read | Download

TWSL2018-003

Vulnerabilities in NETGEAR R8500 router firmware

Feb 07, 2018

Read | Download

TWSL2018-002

Vulnerabilities in NETGEAR R8500 router firmware

Feb 07, 2018

Read | Download

TWSL2018-001

Multiple Vulnerabilities in WD My Cloud personal cloud storage

Feb 01, 2018

Read | Download

TWSL2017-017

Remote Unauthenticated DoS in Debut embedded httpd server used by Brother printers.

Nov 17, 2017

Read | Download

TWSL2017-016

Local kernel heap buffer overflow Vulnerability in ESET DESLock+ client application

Aug 15, 2017

Read | Download

TWSL2017-015

Multiple Vulnerabilities in ManageEngine Applications Manager

Aug 09, 2017

Read | Download

TWSL2017-014

Multiple Vulnerabilities in ManageEngine OpManager

Jul 26, 2017

Read | Download

TWSL2017-013

Multiple Authentication Bypass Vulnerabilities in ManageEngine Applications Manager

Jul 26, 2017

Read | Download

TWSL2017-012

Remote un-authenticated DoS in IPsec-Tools Racoon

Jul 09, 2017

Read | Download

TWSL2017-011

Lockscreen Lockout Bypass in Elephone P9000 Android Smartphone

Jun 28, 2017

Read | Download

TWSL2017-010

Multiple Vulnerabilities in Humax Routers

Jun 28, 2017

Read | Download

TWSL2017-009

Multiple Vulnerabilities in Avast Antivirus

Mar 31, 2017

Read | Download

TWSL2017-008

Unauthenticated Privilege Escalation Vulnerability in Serv-U FTP/MFT Server

Mar 22, 2017

Read | Download

TWSL2017-007

Undocumented Backdoor Account in DBLTek GoIP

Mar 02, 2017

Read | Download

TWSL2017-006

Multiple Vulnerabilities in Polystar Jupiter

Feb 22, 2017

Read | Download

TWSL2017-005

Improper Input Validation Vulnerability in SAP Adaptive Server Enterprise

Feb 13, 2017

Read | Download

TWSL2017-004

Unauthenticated Backdoor Access in Unanet

Feb 08, 2017

Read | Download

TWSL2017-003

Multiple Vulnerabilities in NETGEAR Routers

Jan 30, 2017

Read | Download

TWSL2017-002

Multiple Vulnerabilities in McAfee Security Scan Plus

Jan 23, 2017

Read | Download

TWSL2017-001

Multiple Vulnerabilities in Digitech Systems PaperVision Enterprise

Jan 11, 2017

Read | Download

TWSL2016-021

Plugin authentication by-pass Vulnerability in Microsoft Skype for Mac OS-X

Dec 13, 2016

Read | Download

TWSL2016-020

Buffer Overflow Vulnerability in B Labs Bopup Communication Server

Nov 03, 2016

Read | Download

TWSL2016-019

Multiple XSS Vulnerabilities in Zeuscart

Sep 21, 2016

Read | Download

TWSL2016-018

Multiple Persistent XSS Vulnerabilities in D-Link DSL-2740E ADSL Router

Sep 16, 2016

Read | Download

TWSL2016-017

SQL Injection Vulnerability in SAP Adaptive Server Enterprise

Sep 16, 2016

Read | Download

TWSL2016-016

Multiple Vulnerabilities in Opsview Monitor Pro

Sep 01, 2016

Read | Download

TWSL2016-015

Password Disclosure Vulnerability in Cisco Connected Streaming Analytics

Aug 11, 2016

Read | Download

TWSL2016-014

Vulnerabilities in ComfortLink™ II XL850

Aug 11, 2016

Read | Download

TWSL2016-013

Unrestricted File Creation vulnerability in SAP Adaptive Server Enterprise

Aug 02, 2016

Read | Download

TWSL2016-012

Multiple Vulnerabilities in Lenovo Solution Center

Jun 23, 2016

Read | Download

TWSL2016-011

Multiple Vulnerabilities in Oracle GlassFish Server Open Source Edition 3.0.1

Jun 08, 2016

Read | Download

TWSL2016-010

Information Disclosure vulnerability in SAP ASE Installer

May 26, 2016

Read | Download

TWSL2016-009

Privilege Escalation Vulnerability in Lenovo Solution Center

May 11, 2016

Read | Download

TWSL2016-008

SQL injection vulnerability in SAP ASE

May 09, 2016

Read | Download

TWSL2016-007

Multiple Vulnerabilities in Cacti

Apr 20, 2016

Read | Download

TWSL2016-006

Multiple Vulnerabilities in Zen Cart

Mar 25, 2016

Read | Download

TWSL2016-005

Vulnerabilities in DevArt dotConnect for Oracle

Mar 10, 2016

Read | Download

TWSL2016-004

Multiple Vulnerabilities in Magnolia CMS

Mar 09, 2016

Read | Download

TWSL2016-003

Unsafe unlinking of files in Sophos Antivirus

Mar 09, 2016

Read | Download

TWSL2016-002

Multiple Vulnerabilities in iNovah

Feb 18, 2016

Read | Download

TWSL2016-001

Multiple Vulnerabilities in Cisco Meraki

Jan 13, 2016

Read | Download

TWSL2015-024

Multiple Vulnerabilities in Proxmox Mail Gateway

Dec 30, 2015

Read | Download

TWSL2015-023

Missing authorization check in SAP Adaptive Server Enterprise

Dec 09, 2015

Read | Download

TWSL2015-022

Cross-Site Scripting in VMware Virtual Center Appliance (vCSA) Web Application Console

Nov 17, 2015

Read | Download

TWSL2015-021

Joomla SQL Injection Vulnerability

Oct 22, 2015

Read | Download

TWSL2015-020

Unauthenticated Local File Inclusion Vulnerability in Oracle Open Commerce Platform 3.4

Oct 20, 2015

Read | Download

TWSL2015-019

Privilege escalation vulnerability in Oracle Database

Oct 20, 2015

Read | Download

TWSL2015-018

Service Privilege Elevation in Lenovo System Update 5

Oct 15, 2015

Read | Download

TWSL2015-017

Reflected File Download in Red Hat Feedhenry

Oct 09, 2015

Read | Download

TWSL2015-016

Path Traversal in Oracle GlassFish Server Open Source Edition

Aug 27, 2015

Read | Download

TWSL2015-015

Multiple Vulnerabilities in SAP Adaptive Server Enterprise

Jul 17, 2015

Read | Download

TWSL2015-014

Account Probing Vulnerability in Oracle Database

Jul 15, 2015

Read | Download

TWSL2015-013

Buffer Overflow Vulnerability in Oracle MySQL

Jul 15, 2015

Read | Download

TWSL2015-012

XSS in Oracle Java Server Faces

Jul 15, 2015

Read | Download

TWSL2015-011

Vulnerability in the pam\_unix module in Linux-PAM

Jun 26, 2015

Read | Download

TWSL2015-010

Reflected Cross-site Scripting Vulnerabilities in codeBeamer

Jun 09, 2015

Read | Download

TWSL2015-009

Request Hijacking Bypass Vulnerability In RubyGems

Jun 08, 2015

Read | Download

TWSL2015-008

Multiple Vulnerabilities in SAP Adaptive Server Enterprise

May 22, 2015

Read | Download

TWSL2015-007

Request Hijacking Vulnerability In RubyGems

May 18, 2015

Read | Download

TWSL2015-006

Multiple Vulnerabilities in QlikView

May 13, 2015

Read | Download

TWSL2015-005

Blind SQL injection in XpanceNET

Apr 24, 2015

Read | Download

TWSL2015-004

"Probe" login access vulnerability in SAP ASE

Apr 23, 2015

Read | Download

TWSL2015-003

Multiple Vulnerabilities in SAP Adaptive Server Enterprise

Mar 19, 2015

Read | Download

TWSL2015-002

Cross-Site Scripting in Magnolia CMS

Feb 12, 2015

Read | Download

TWSL2015-001

Multiple Vulnerabilities in IceWarp Mail Server

Feb 12, 2015

Read | Download

TWSL2014-016

Reflected Cross-Site Scripting Vulnerability in VMware Virtual Center Appliance (vCSA) Web Application Console

Dec 05, 2014

Read | Download

TWSL2014-015

Cross Site Scripting Vulnerability in Gizmox WebGui

Oct 29, 2014

Read | Download

TWSL2014-014

Multiple Vulnerabilities in Gerber WebPDM Product Data Management System

Oct 24, 2014

Read | Download

TWSL2014-013

Privilege Escalation Vulnerability and Potential Remote Code Execution in SAP Adaptive Server Enterprise

Sep 12, 2014

Read | Download

TWSL2014-012

Secure Desktop Protection Bypass in 1Password for Windows

Aug 05, 2014

Read | Download

TWSL2014-011

Secure Desktop Protection Bypass in Keepass

Aug 05, 2014

Read | Download

TWSL2014-010

Multiple Vulnerabilities in Wing FTP Server

Jul 02, 2014

Read | Download

TWSL2014-009

Multiple Vulnerabilities in BSS Company Software

Jul 01, 2014

Read | Download

TWSL2014-008

Cross Site Scripting Vulnerability in Cisco ASA

May 28, 2014

Read | Download

TWSL2014-007

Multiple Vulnerabilities in Y-Cam

May 01, 2014

Read | Download

TWSL2014-006

NetSupport Manager Information Disclosure Vulnerability

Apr 17, 2014

Read | Download

TWSL2014-005

VPN Privilege Escalation Vulnerability in Cisco ASA

Apr 09, 2014

Read | Download

TWSL2014-004

Information Disclosure in the BC Collected Information Export Extension for eZ Publish CMS

Mar 20, 2014

Read | Download

TWSL2014-003

Blind SQL Injection Vulnerability in Tableau Server

Jan 24, 2014

Read | Download

TWSL2014-002

Buffer Overflow Vulnerability in DaumGame ActiveX

Jan 06, 2014

Read | Download

TWSL2014-001

Multiple Vulnerabilities in Franklin Fueling's TS-550 evo

Jan 03, 2014

Read | Download

TWSL2013-034

Path Traversal Vulnerability in WiFi HD Free

Nov 20, 2013

Read | Download

TWSL2013-033

Multiple Vulnerabilities in Easy File Manager

Nov 20, 2013

Read | Download

TWSL2013-032

Path Traversal Vulnerability in FTPDrive

Nov 20, 2013

Read | Download

TWSL2013-031

Information Disclosure Vulnerability in RiskNet Acquirer

Nov 07, 2013

Read | Download

TWSL2013-030

Multiple Vulnerabilities in Quixplorer

Nov 06, 2013

Read | Download

TWSL2013-029

Information Disclosure Vulnerability in QNAP Photo Station

Sep 27, 2013

Read | Download

TWSL2013-028

Persistent Denial of Service Vulnerability in Vino VNC Server

Sep 16, 2013

Read | Download

TWSL2013-027

Multiple Vulnerabilities in ajaXplorer

Sep 05, 2013

Read | Download

TWSL2013-026

Multiple Web Application Vulnerabilities in RockMongo

Aug 16, 2013

Read | Download

TWSL2013-025

Arbitrary File Upload Vulnerability in Official Nmap

Aug 02, 2013

Read | Download

TWSL2013-024

Cross Site Scripting (XSS) vulnerability in McAfee Superscan 4.0

Aug 02, 2013

Read | Download

TWSL2013-023

Lack of Web and API AuthenticationVulnerability in INSTEON Hub

Aug 01, 2013

Read | Download

TWSL2013-022

No Authentication Vulnerability in Radio Thermostat

Aug 01, 2013

Read | Download

TWSL2013-021

Multiple Vulnerabilities in Karotz Smart Rabbit

Aug 01, 2013

Read | Download

TWSL2013-020

Hard-Coded Bluetooth PIN Vulnerability in LIXIL Satis Toilet

Aug 01, 2013

Read | Download

TWSL2013-018

Multiple Vulnerabilities in OpenEMR

Jul 12, 2013

Read | Download

TWSL2013-008

Command Injection Vulnerabilities in Linksys Routers.

May 31, 2013

Read | Download

TWSL2013-007

Multiple Vulnerabilities in VLC Media Player - Web Interface.

Jun 10, 2013

Read | Download

TWSL2013-006

Cross-Site Scripting Vulnerability in Coldbox.

Jun 10, 2013

Read | Download

TWSL2013-004

Group Name Enumeration Vulnerability in Cisco IKE Implementation.

Apr 18, 2013

Read | Download

TWSL2013-002

Multiple XSS Vulnerabilities in The Bug Genie.

May 09, 2013

Read | Download

TWSL2012-019

Cross-Site Scripting Vulnerability in Support Incident Tracker

Aug 29, 2012

Read | Download

TWSL2012-016

Multiple Vulnerabilities in Bitweaver

Oct 23, 2012

Read | Download

TWSL2012-014

Multiple Vulnerabilities in Scrutinizer NetFlow and sFlow Analyzer

Jul 27, 2012

Read | Download

TWSL2012-012

Cross-Site Scripting Vulnerability in Support Incident Tracker

Apr 20, 2012

Read | Download

TWSL2012-008

Multiple Vulnerabilities in Scrutinizer NetFlow

Apr 10, 2012

Read | Download

TWSL2012-005

Cross-Site Scripting Vulnerability in osCommerce Platform

Mar 23, 2012

Read | Download

TWSL2012-004

Multiple Vulnerabilities in Zen Cart

May 03, 2012

Read | Download

TWSL2012-003

Cross-Site Scripting Vulnerability in Movable Type Publishing Platform

Feb 24, 2012

Read | Download

TWSL2012-002

Multiple Vulnerabilities in WordPress

Jan 24, 2012

Read | Download

TWSL2012-001

Cross-Site Scripting Vulnerability in Textpattern Content Management System

Jan 03, 2012

Read | Download

TWSL2011-019

Cross-Site Scripting Vulnerability in phpMyAdmin

Dec 22, 2011

Read | Download

TWSL2011-018

Authentication Bypass Vulnerability in IBM TS3100/TS3200 Web User Interface

Dec 20, 2011

Read | Download

TWSL2011-017

Multiple Vulnerabilities in Merethis Centreon

Nov 04, 2011

Read | Download

TWSL2011-014

Vulnerability in Pantech Web Browser SSL Implementation

Sep 23, 2011

Read | Download

TWSL2011-013

Multiple Vulnerabilities in IceWarp Mail Server

Sep 23, 2011

Read | Download

TWSL2011-008

Focus Stealing Vulnerability in Android

Aug 06, 2011

Read | Download

TWSL2011-007

iOS SSL Implementation Does Not Validate Certificate Chain

Jul 25, 2011

Read | Download

TWSL2011-006

IBM Web Application Firewall Bypass

Jun 21, 2011

Read | Download

TWSL2011-005

Directory Traversal in Trustwave WebDefend Enterprise

Jun 17, 2011

Read | Download

TWSL2011-004

Cross-Site Scripting Vulnerability in ZyXEL ZyWALL 70 Firewall

Jun 10, 2011

Read | Download

TWSL2011-003

Vulnerabilities discovered in Avocent Cyclades ACS Web Manager

Mar 11, 2011

Read | Download

TWSL2011-002

Vulnerabilities in Comcast DOCSIS 3.0 Business Gateways (SMCD3G-CCR)

Feb 04, 2011

Read | Download

TWSL2011-001

Vulnerabilities in Trustwave WebDefend Enterprise

Feb 15, 2011

Read | Download

TWSL2010-008

Clear iSpot/Clearspot CSRF Vulnerabilities

Dec 10, 2010

Read | Download

TWSL2010-007

Passlogix v-GO Self-Service Password Reset Bypass via Invalid SSL Certificate

Dec 10, 2010

Read | Download

TWSL2010-006

Multiple Vulnerabilities in Camtron CMNC-200 IP Camera

Nov 12, 2010

Read | Download

TWSL2010-005

FreePBX recordings interface allows remote code execution

Sep 23, 2010

Read | Download

TWSL2010-003

Unauthorized access to root NFS export on EMC Celerra Network Attached Storage(NAS) appliance

Jul 29, 2010

Read | Download

TWSL2010-002

Web Service Hijacking in VMWare WebAccess

Mar 30, 2010

Read | Download

TWSL2010-001

View state tampering vulnerabilities in products from Microsoft, Apache, and Sun Microsystems

Feb 03, 2010

Read | Download

TWSL2009-002

Cisco's Adaptive Security Appliance (ASA) Web VPN Multiple Vulnerabilities

Jun 24, 2009

Read | Download

TWSL2009-001

Profense Web Application Firewall and Load Balancer multiple vulnerabilities

May 19, 2009

Read | Download

**Related SpiderLabs Blogs**

CVE-2022-37461: Trustwave Security Advisories

Plus: WhatsApp plugs holes that could be used for remote execution attacks, Microsoft patches a zero-day vulnerability, and more.

None of the issues patched by Google are known to have been exploited in attacks, but if the update is available to you, it’s a good idea to apply it as soon as possible.

Microsoft

Microsoft Patch Tuesday is an important one because it comes with a fix for a flaw already being used in attacks. The zero-day vulnerability, tracked as CVE-2022-37969, is a privilege escalation issue in the Windows Common Log File System Driver that could allow an adversary to take control of the machine.

The zero-day is among 63 vulnerabilities patched by Microsoft, including five rated as critical. These include CVE-2022-34722 and CVE-2022-34721, remote code execution (RCE) flaws in the Windows Internet Key Exchange Protocol (IKE) which both have a CVSS score of 9.8.

Later in September, Microsoft issued an out-of-band security update for a spoofing vulnerability in its Endpoint Configuration Manager tracked as CVE 2022 37972.

WhatsApp

Encrypted messaging service WhatsApp has released an update to fix two vulnerabilities that could result in remote code execution. CVE-2022-36934 is an integer overflow issue in WhatsApp for Android prior to v2.22.16.12, Business for Android prior to v2.22.16.12, iOS prior to v2.22.16.12, and Business for iOS prior to v2.22.16.12, which could result in remote code execution in a video call.

Meanwhile, CVE-2022-27492 is an integer underflow flaw in WhatsApp for Android prior to v2.22.16.2 and WhatsApp for iOS v2.22.15.9 that could have caused remote code execution for someone receiving a crafted video file, according to the WhatsApp security advisory.

WhatsApp patched these flaws about a month ago, so if you are running the current version, you should be safe.

HP

HP has fixed a serious issue in the support assistant tool that comes preinstalled on all of its laptops. The privilege escalation bug in HP Support Assistant is ranked as a high-severity issue and is tracked as CVE-2022-38395.

HP has released only limited details about the vulnerability on its support page, but it goes without saying that those with affected equipment should ensure they update now.

SAP

SAP’s September Patch Day saw the release of 16 new and updated patches, including three high-priority fixes for SAP Business One, SAP BusinessObjects, and SAP GRC.

The SAP Business One fix, which patches an Unquoted Service Path vulnerability, is the most critical of the three. Attackers could exploit the flaw “to execute an arbitrary binary file when the vulnerable service starts, which could allow it to escalate privileges to SYSTEM,” security firm Onapsis says.

A second fix for SAP BusinessObjects patches an information disclosure vulnerability. “Under certain conditions, the vulnerability allows an attacker to gain access to unencrypted sensitive information in the Central Management Console of SAP BusinessObjects Business Intelligence Platform,” says Onapsis in its blog.

The third High Priority Note affecting SAP GRC customers could allow an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad.

Cisco

Software giant Cisco has issued a patch to fix a high-severity security issue in the binding configuration of SD-WAN vManage software containers. Tracked as CVE-2022-20696, the flaw could allow an unauthenticated attacker who has access to the VPN0 logical network to access the messaging service ports on an affected system.

“A successful exploit could allow the attacker to view and inject messages into the messaging service, which can cause configuration changes or cause the system to reload,” Cisco warned in an advisory.

Sophos

Security company Sophos has just fixed an RCE flaw in its firewall product that it says is already being used in attacks. Tracked as CVE-2022-3236, the code injection vulnerability was discovered in the User Portal and Webadmin of Sophos Firewall.

“Sophos has observed this vulnerability being used to target a small set of specific organizations, primarily in the South Asia region,” the firm said in a security advisory.

WP Gateway WordPress Plugin

A vulnerability in a WordPress plugin called AP Gateway is already being used in attacks. Tracked as CVE-2022-3180, the privilege escalation bug could allow attackers to add a malicious user with admin privileges to take over sites running the plugin.

“As this is an actively exploited zero-day vulnerability, and attackers are already aware of the mechanism required to exploit it, we are releasing this public service announcement to all of our users,” said Ram Gall, a Wordfence senior threat analyst, adding that certain details have been withheld intentionally to prevent further exploitation.

Go Update iOS, Chrome, and HP Computers to Fix Serious Flaws

A "highly operational, destructive, and sophisticated nation-state activity group" with ties to North Korea has been weaponizing open source software in their social engineering campaigns aimed at companies around the world since June 2022.
Microsoft's threat intelligence teams, alongside LinkedIn Threat Prevention and Defense, attributed the intrusions with high confidence to Zinc, which is

A "highly operational, destructive, and sophisticated nation-state activity group" with ties to North Korea has been weaponizing open source software in their social engineering campaigns aimed at companies around the world since June 2022.

Microsoft's threat intelligence teams, alongside LinkedIn Threat Prevention and Defense, attributed the intrusions with high confidence to **Zinc**, which is also tracked under the names Labyrinth Chollima.

Attacks targeted employees in organizations across multiple industries, including media, defense and aerospace, and IT services in the U.S., the U.K., India, and Russia.

The tech giant said it observed Zinc leveraging a "wide range of open-source software including PuTTY, KiTTY, TightVNC, Sumatra PDF Reader, and muPDF/Subliminal Recording software installer for these attacks."

According to CrowdStrike, Zinc "has been active since 2009 in operations aimed at collecting political, military, and economic intelligence on North Korea's foreign adversaries and conducting currency generation campaigns."

The latest findings dovetail with a recent report from Google-owned Mandiant, which uncovered the adversary's use of PuTTY via fraudulent job lures shared with potential targets on LinkedIn as part of a campaign dubbed Operation Dream Job.

This involves establishing initial connections with individuals by posing as recruitment professionals as a trust-building exercise, before moving the conversation to WhatsApp, where a tailored lure document or seemingly benign software is shared, effectively activating the infection sequence.

A successful compromise is followed by the threat actor moving laterally across the network and exfiltrating collected information of interest by deploying a backdoor called ZetaNile (aka BLINDINGCAN OR AIRDRY).

But in a bid to evade security defenses and avoid raising red flags, the implant is downloaded only when the victim uses the SSH clients to connect to a particular IP address through the credentials specified in a separate text file.

Likewise, attacks employing the trojanized version of TightVNC Viewer are configured to install the backdoor only when the user selects a particular remote host from the options provided.

"Zinc attacks appear to be motivated by traditional cyberespionage, theft of personal and corporate data, financial gain, and corporate network destruction," the company said.

"Zinc attacks bear many hallmarks of state-sponsored activities, such as heightened operational security, sophisticated malware that evolves over time, and politically motivated targeting."

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

North Korean Hackers Weaponizing Open-Source Software in Latest Cyber Attacks

Combination of two companies to help SAP customers streamline audit, compliance and control processes.

DALLAS, Sept. 27, 2022 /PRNewswire/ -- Pathlock, the leading provider of application security and controls automation for critical business applications, today announced the acquisition of Grey Monarch, a UK-based specialist SAP Partner dedicated to SAP Process Automation. The acquisition will strengthen Pathlock's vision of providing the industry's most complete 360-degree platform for application security and controls automation for the SAP ecosystem.

Since 2008, Grey Monarch has developed expertise in SAP Security, Segregation of Duties, SAP Licence Optimization, SAP Background Processing Automation and Secure Managed File Transfer. With this acquisition, the SAP community will benefit from the very best SAP Process Automation advice, implementation skills, and software and training capabilities, improving levels of security, enhancing their users' experience and streamlining audit, compliance and control procedures.

"It's now more imperative than ever for organizations to utilize a holistic view of user access and privileges so they can be managed, monitored and controlled to ensure the maximum protection of data, business processes and intellectual property," said David Lloyd, Director and Co-Founder, Grey Monarch. "Combining Grey Monarch's capabilities with the Pathlock family of expertise, resources and product portfolio will provide our customers, existing and new, with an unsurpassed visibility into their business applications."

"We're thrilled to complete the acquisition of Grey Monarch," said Piyush Pandey, CEO of Pathlock. "We continue to see a strong demand for our globally recognized application security and controls automation solutions, and know that with Grey Monarch's specialization in SAP process automation we can continue to enable our global customers to revolutionize the way they secure their sensitive financial and customer data."

In May 2022, Pathlock announced a $200M capital raise sponsored by Vertica Capital Partners alongside a merger with Appsian and Security Weaver and the acquisition of Belgium-based CSI Tools and Germany-based SAST SOLUTIONS. The company has successfully doubled in size in terms of revenue and employees and is now servicing over 1,400 customers across all major industries on a global scale with offices across the United States, Belgium, the UK, Germany, Israel and India.

**About Pathlock**

Pathlock is the leader in application security and controls automation. With Pathlock, enterprises can manage all aspects of access governance via a single platform, across applications, including user provisioning, ongoing User Access Reviews, segregation of duties, control testing, and audit preparation. Today, many of the world's most respected, global 2000 companies rely on Pathlock to protect their critical digital assets from financial, operational, regulatory and security threats, ensure corporate compliance and improve performance. Our customers have saved millions in employee productivity, labor costs, audit fees and data loss prevention.

Pathlock Expands SAP Capabilities with Acquisition of Grey Monarch

Red Hat Security Advisory 2022-6741-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include a privilege escalation vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: kernel security and bug fix update  
Advisory ID:       RHSA-2022:6741-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:6741  
Issue date:        2022-09-28  
CVE Names:         CVE-2022-1729   
=====================================================================

1. Summary:

An update for kernel is now available for Red Hat Enterprise Linux 7.7  
Advanced Update Support, Red Hat Enterprise Linux 7.7 Telco Extended Update  
Support, and Red Hat Enterprise Linux 7.7 Update Services for SAP  
Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 7.7) - noarch, x86_64  
Red Hat Enterprise Linux Server E4S (v. 7.7) - noarch, ppc64le, x86_64  
Red Hat Enterprise Linux Server Optional AUS (v. 7.7) - x86_64  
Red Hat Enterprise Linux Server Optional E4S (v. 7.7) - ppc64le, x86_64  
Red Hat Enterprise Linux Server Optional TUS (v. 7.7) - x86_64  
Red Hat Enterprise Linux Server TUS (v. 7.7) - noarch, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux  
operating system.

Security Fix(es):

* kernel: race condition in perf_event_open leads to privilege escalation  
(CVE-2022-1729)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

Bug Fix(es):

* Posix ACL object is leaked in several places upon setattr and fsetxattr  
syscalls (BZ#2106586)

* netfilter: backports from upstream (BZ#2120634)

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2086753 - CVE-2022-1729 kernel: race condition in perf_event_open leads to privilege escalation

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 7.7):

Source:  
kernel-3.10.0-1062.70.1.el7.src.rpm

noarch:  
kernel-abi-whitelists-3.10.0-1062.70.1.el7.noarch.rpm  
kernel-doc-3.10.0-1062.70.1.el7.noarch.rpm

x86_64:  
bpftool-3.10.0-1062.70.1.el7.x86_64.rpm  
bpftool-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-headers-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-libs-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server E4S (v. 7.7):

Source:  
kernel-3.10.0-1062.70.1.el7.src.rpm

noarch:  
kernel-abi-whitelists-3.10.0-1062.70.1.el7.noarch.rpm  
kernel-doc-3.10.0-1062.70.1.el7.noarch.rpm

ppc64le:  
bpftool-3.10.0-1062.70.1.el7.ppc64le.rpm  
bpftool-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-bootwrapper-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-debug-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-debuginfo-common-ppc64le-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-devel-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-headers-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-tools-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-tools-libs-3.10.0-1062.70.1.el7.ppc64le.rpm  
perf-3.10.0-1062.70.1.el7.ppc64le.rpm  
perf-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
python-perf-3.10.0-1062.70.1.el7.ppc64le.rpm  
python-perf-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm

x86_64:  
bpftool-3.10.0-1062.70.1.el7.x86_64.rpm  
bpftool-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-headers-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-libs-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server TUS (v. 7.7):

Source:  
kernel-3.10.0-1062.70.1.el7.src.rpm

noarch:  
kernel-abi-whitelists-3.10.0-1062.70.1.el7.noarch.rpm  
kernel-doc-3.10.0-1062.70.1.el7.noarch.rpm

x86_64:  
bpftool-3.10.0-1062.70.1.el7.x86_64.rpm  
bpftool-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-headers-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-libs-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 7.7):

x86_64:  
bpftool-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-libs-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Optional E4S (v. 7.7):

ppc64le:  
bpftool-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-debug-devel-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-debuginfo-common-ppc64le-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
kernel-tools-libs-devel-3.10.0-1062.70.1.el7.ppc64le.rpm  
perf-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm  
python-perf-debuginfo-3.10.0-1062.70.1.el7.ppc64le.rpm

x86_64:  
bpftool-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-libs-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Optional TUS (v. 7.7):

x86_64:  
bpftool-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
kernel-tools-libs-devel-3.10.0-1062.70.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1062.70.1.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-1729  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYzSXBtzjgjWX9erEAQjKrQ//UMJzCqtbTKo49Rw2Q5bNpiBbMYIczHLu  
uVWQDb82h2K2Ky3qpGHMIQuhMb/pr0k+9Q+MzjEzkIEnDW4iwXvApz2snWy+jXD9  
nqnsBPuQqU/4bCGIJYRw+b6/onxXUzFU58opqkoOcOR1bEpc+7VTCwGwH6KExb3s  
X6BQTyLmIHkcdMl6qzDtw4JqU591mDgujbxAXo/FTh2C2gIaFV1/TWHNNRe6OoDJ  
1HQqthx4aWoY4rK2cHLdwuG0gdGK6QTy/lEAu0+79YiVYrBgWK5yTuyyyLGD8SXQ  
Fn+c4KMjIO3I1FbQwzGmYuRjrQjatJZJczRt+MLo5DxoSbraf7Y7zn3lI6VtKPX9  
snqgjZ6vZ0AUkN2bMRRtiA0QRTkqy/FAr+OlSdJaLCLGXRKZfk8vh7Es4bYpO8Mx  
2GzpwthdFyyWcgyoEDI6WCp4t4oaAkKZu5rLoa8563icrcTLRMAdUM4IMNuUOI1q  
S4ovejF2K4G7gaUS2V/i5N298+B8vr10yEtNPHiQ7SZKdjQ+SXD+fkr2Joz/GsSo  
ozjIYjBsi/Oglk3G7CVJPWUVWf+CsLZHg3ucSsCT2FMFkACtZLbht1wEHzg5kvWc  
Qj6KpVi4RJ+ZrYrMCi0EB0ejYbQrkLQpCBIRmN7zLrEyPB+qTq2yquYHffmSpdmW  
jfydo6q/6as=  
=rbbu  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-6741-01

A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.

CVE-2022-40407: Security issues - Chamilo LMS

A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service (DoS) via a crafted NFC file.

**Exploiting Flipper Zero’s NFC file loader**

Flipper Zero is a self-described _portable multi-tool for pentesters and geeks in a toy-like body_. The device comes with several built-in applications to transmit and recieve sub-1GHz frequencies, such as RFID, NFC, and Bluetooth.

This post demonstrates a buffer overflow in Flipper Zero’s NFC file loader that I discovered for BGGP3.

**You Wouldn’t Download a Wolf Link**

Nintendo Amiibos are collectible figurines with an embedded NFC chip that grant special in-game items on the Nintendo Switch. At anywhere from $15 to $70 USD, and considerably more for limited editions, it’s not surprising there’s an active community around cloning and emulating these NFCs.

Anyway, I just bought a Flipper Zero to keep amiibos from overflowing my desk and if you’re reading this you probably did too. The problem, or opportunity, is Flipper Zero firmware up to 0.65.2 is vulnerable to a buffer overflow that can crash your device and maybe execute code, who knows. The latest version, released 06 Sept 2022, includes the patch for this vulnerability.

Before we dive in, let’s look at how a Flipper Zero stores Amiibo files.

    Filetype: Flipper NFC device
    Version: 2
    # Nfc device type can be UID, Mifare Ultralight, Mifare Classic, Bank card
    Device type: NTAG215
    # UID, ATQA and SAK are common for all formats
    UID: 04 C1 8A 01 27 40 03
    ATQA: 44 00
    SAK: 00
    # Mifare Ultralight specific data
    Data format version: 1
    Signature: 35 47 82 B2 E9 D5 8F 70 C3 BC 79 FE 8A ED 77 16 EC 25 8C 9A 95 32 4B 94 19 00 2E 12 5A D0 AC 90
    Mifare version: 00 04 04 02 01 00 11 03
    Counter 0: 0
    Tearing 0: 00
    Counter 1: 0
    Tearing 1: 00
    Counter 2: 95
    Tearing 2: 00
    Pages total: 4
    Pages read: 4
    Page 0: 33 33 33 33
    Page 1: 33 33 33 33
    Page 2: 33 33 33 33
    Page 3: 33 33 33 33
    

The NFC file contains some metadata indicating the device type, version, and so on. We’re not really concerned with that and anyway the code to parse them looks fine. What we do care about is the page total field, here 4 and the 4 bytes of page data in each page which I’ve set to 0x33 for readability.

**Buffer Overflow**

A buffer overflow exists in the nfc_device_load_mifare_ul_data function of nfc_device.c that allows out of bounds write on the dev_data.mf_ul_data.data buffer. If you need a refresher on memory corruption bugs on ARM chips then best check Azeria’s blog on the subject.

The Flipper firmware hardcodes the length of the NFC data buffer MF_UL_MAX_DUMP_SIZE at 2040 bytes, enough to store data from the largest Mifare chips. When this function reads an NFC file it does not check that the length of page data in the file is less than the length of this buffer. Since there’s no check to prevent more than 510 pages from being read (510 \* 4 = 2040 bytes), nor a check to ensure the data read is less than the length of MF_UL_MAX_DUMP_SIZE, we can store up to uint16_t pages of data in our file and read enough of them into memory to corrupt the device.

This may result in various crashes including a BusFault crash and a NULL pointer exception. In some cases, the device is unresponsive to a reboot (idk why, sorry) and must be re-flashed to recover it.

**BGGP3**

This is my first year participating in Binary Golf Grand Prix 3. The rules are simple; you need to crash a program using a file of no more than 4096 bytes. Unfortunately, this NFC file is way too large to be a valid entry (it’s a chonky 23k), but I still had fun finding a bug, writing the exploit, and writing a patch for the Flipper Zero firmware.

Special thanks to all the lovely people at BGGP who took time to organize this event, review submissions, offer support and encouragement, and to all the ghosts.

BGGP3 has bonus challenges that each grant additional points if completed. Copy pasta from their site:

    Bonus points will be awarded for the following additional accomplishments:
    
    +1024 pts, if you submit a writeup about your process and details about the crash
    +1024 pts, if the program counter is all 3's when the program crashes
    +2048 pts, if you hijack execution and print or return "3"
    +4096 pts, if you author a patch for your bug which is merged before the end of the competition
    

**Count to 3**

Reminder that this bug is a heap based buffer overflow. We’re writing out of bounds on the dev.dev_data.mf_ul_data.data buffer which for this example we’ll say is stored in struct dev at address 0x2000f9e0. In order to make the program call into code we control, we’ll need to find a value somewhere on the heap (at a higher address than the start of our buffer) that we can reach without crashing the program.

Very lucky that the dev struct contains the address of a callback function! Let’s look at that in the code.

     1
     2
     3
     4
     5
     6
     7
     8
     9
    10
    11
    12
    

    typedef struct {
        Storage* storage;
        DialogsApp* dialogs;
        NfcDeviceData dev_data;
        char dev_name[NFC_DEV_NAME_MAX_LEN + 1];
        string_t load_path;
        NfcDeviceSaveFormat format;
        bool shadow_file_exist;
    
        NfcLoadingCallback loading_cb;  // owo
        void* loading_cb_ctx;
    } NfcDevice;
    

After loading the NFC file, the program does a bit of cleanup and then calls the loading_cb function as it transitions between sub-menus. So if we can control the address without crashing we’re guaranteed to load this code right away.

After end of the data buffer, 0x4242, I’ve copied the heap bytes up to 0xcccccccc as they appear when the buffer is 2040 bytes long and not overflowed, so the payload is rebuilding the dev struct on the heap (you’ll need to fix the alignment too) to reach the address of the loading_cb function in the dev struct. It looks like this:

    0x20010a60:	0x41414141	0x41414141	0x41414141	0x41414141
    0x20010a70:	0x41414141	0x41414141	0x41414141	0x41414141
    0x20010a80:	0x41414141	0x41414141	0x41414141	0x42424141
    0x20010a90:	0x67627067	0x00330000	0x00000000	0x00000000
    0x20010aa0:	0x00000000	0x00000000	0x00120000	0x001c0000
    0x20010ab0:	0x0a402001	0x00020000	0xcccccccc	0x20002000
    

Oopsie!  

**Print 3**

We can control some data on the heap, and we can control a callback pointer. So how can we get the program to print 3?

This image shows the number of pages read from the NFC file as 3 of 511. It should say 510 of 511, so what’s going on here?

Look at the NFC data on the heap and you’ll notice that immediately following the page data is the number 0x07f8.

    ...
    0x2000e4a8: 0x41414141 0x41414141 0x41414141 0x41414141
    0x2000e4b8: 0x41414141 0x41414141 0x41414141 0x41414141
    0x2000e4c8: 0x42424141 0x07f84242 0x00000000 0x00000000
    

0x07f8 is the length of the MF_UL_MAX_DUMP_SIZE buffer (2040 bytes). Divide by 4 and you have the number of pages read. To print 3 instead of the actual page count, just replace this value with 0x0c which results in 3 when divided by 4.

But the challenge is _code execution!_ Just overflowing a value on the stack isn’t very cash money of me.

So let’s talk about ROP. In another post haha. I was hoping to modify one of the menu animations to include BGGP3 but I’ve run out of time. >.<

**Patching the bug**

The final challenge is to submit a patch and have it merged before the end of the competition. My patch was submitted on the last day of BGGP3 and merged into the Flipper Zero firmware repository on Sept 5, after the competition closed.

The patch is a one-liner that checks if the size of either data_size or data_read is greater than the length of MF_UL_MAX_DUMP_SIZE buffer. If it is, the function breaks triggering a file parser failure which is the same behaviour as the other checks on the NFC metadata fields.

Here’s the patch. Ezpz.

    if(data->data_size > MF_UL_MAX_DUMP_SIZE || data->data_read > MF_UL_MAX_DUMP_SIZE) break;
    

Flipper ZeroBGGP3AmiiboNFCNintendo

1311 Words

2022-09-05 20:00 -0400

CVE-2022-40363: Your Amiibo's Haunted

IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPP_TEMPLATE_FLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Tag

#sap