Ramon de C Valle - Security Researcher - Exploit Intelligence Platform

CVE-2014-0224 NOMISEC HIGH WORKING POC

SSL Labs API Client

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

CVSS 7.4

View Code

CVE-2011-3192 EXPLOITDB c WORKING POC

Apache HTTP Server < 2.0.65 - Denial of Service

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

View Code

CVE-2013-2143 METASPLOIT ruby WORKING POC

Redhat Network Satellite < 1.5.0-14 - Improper Input Validation

The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

View Code

CVE-2013-2113 METASPLOIT ruby WORKING POC

Redhat Openstack < 1.2.0 - Access Control

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.

View Code

CVE-2013-2050 METASPLOIT ruby WORKING POC

Redhat Cloudforms Management Engine < 5.0 - SQL Injection

SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.

View Code

CVE-2014-6593 METASPLOIT ruby WORKING POC

Oracle Java SE <8.0 - Info Disclosure

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.

View Code

CVE-2015-1793 METASPLOIT MEDIUM ruby WORKING POC

Oracle Supply Chain Products Suite < 2.0.0.6 - Security Feature Bypass

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.

CVSS 6.5

View Code

CVE-2014-6271 METASPLOIT CRITICAL ruby WORKING POC

Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CVSS 9.8

View Code

CVE-2007-5243 METASPLOIT ruby WORKING POC