[FD] HP ThinPro - Application filter bypass

2020-03-25 Thread Eldar Marcussen
6.2 Credit - Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The HP ThinPro allows administrators to determine what applications users can run, however attackers can bypass

[FD] HP ThinPro - Privilege escalation

2020-03-25 Thread Eldar Marcussen
Credit - Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The ThinPro platform relies on the presence of a file to determine if it is operating in Administrative or User mode

[FD] HP ThinPro - Citrix command injection

2020-03-25 Thread Eldar Marcussen
Credit - Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The Citrix receiver conection wrapper function does not safely handle user supplied data allowing an unauthenticated

[FD] HP ThinPro - Information disclosure

2020-03-25 Thread Eldar Marcussen
Credit - Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - If the thin client is configured with `local user must login` then an unauthenticated attacker with physical access

[FD] HP ThinPro - Privileged command injection

2020-03-25 Thread Eldar Marcussen
6.2 Credit - Eldar Marcussen - xen1thLabs - Software Labs Vulnerability summary - The VPN software does not safely handle user supplied input, it is therefore possible for an attacker to inject

[FD] Sabberworm PHP CSS parser - Code injection vulnerability

2020-06-03 Thread Eldar Marcussen
- Eldar Marcussen - justanotherhacker.com Vulnerability summary - The Sabberworm PHP CSS Parser evaluates uncontrolled data which may result in remote code execution if the affected function is called with attacker