Bourbon Jean-marie (kmkz)

3 exploits Active since Mar 2017
CVE-2018-10682 WRITEUP CRITICAL WRITEUP
WildFly 10.1.2.Final - Unauthenticated Remote Code Execution via Administration Panel
An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default (auto-deployment) permits an anonymous user to deploy a malicious .war file, leading to remote code execution. NOTE: the vendor indicates that anonymous access is not available in the default installation; however, it remains optional because there are several use cases for it, including development environments and network architectures that have a proxy server for access control to the WildFly server
CVSS 9.8
CVE-2018-10683 WRITEUP CRITICAL WRITEUP
WildFly 10.1.2.Final - Unauthenticated Access via Missing Security Realm
An issue was discovered in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "without a security realm reference" implies "effectively unsecured." The vendor explicitly supports these unsecured configurations because they have valid use cases during development
CVSS 9.8
CVE-2017-5671 EXPLOITDB HIGH text WORKING POC
Honeywell Intermec Printers < 10.11.013310 - Local Privilege Escalation via BusyBox Jailbreak
Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriting the /etc/shadow file.
CVSS 8.8