Packet Storm New Exploits For October, 2024 –
– This archive contains all of the 128 exploits added to Packet Storm in October, 2024. – Read More – Packet Storm
Category: Alert Feeds
ABB Cylon Aspect 3.08.01 File Upload MD5 Checksum Bypass –
– ABB Cylon Aspect version 3.08.01 has a vulnerability in caldavInstall.php, caldavInstallAgendav.php, and caldavUpload.php files, where the presence of an EXPERTMODE parameter activates a badassMode feature. This mode allows an unauthenticated attacker to bypass MD5 checksum validation during file uploads. By enabling badassMode and setting the skipChecksum parameter, the system skips integrity verification, allowing attackers to upload or install altered CalDAV...
Ping Identity PingIDM 7.5.0 Query Filter Injection –
– Ping Identity PingIDM versions 7.0.0 through 7.5.0 enabled an attacker with read access to the User collection, to abuse API query filters in order to obtain managed and/or internal user’s passwords in either plaintext or encrypted variants, based on configuration. The API clearly prevents the password in either plaintext or encrypted to be retrieved by any other means, as this...
