{"vulnerability": "CVE-2020-2891", "sightings": [{"uuid": "fbf5df5e-e739-4869-8eaf-f5087e1f1af1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28910", "type": "published-proof-of-concept", "source": "https://t.me/ptswarm/42", "content": "\"13 Nagios Vulnerabilities, #7 will SHOCK you!\" by Samir Ghanem\n\nGaining access to Nagios XI server results in upstream compromise of management server,  i.e. every other customer monitored. Exploitation facilitated with soygun tool.\n\nContents:\n \u2022 TL;DR\n \u2022 Why Nagios?\n \u2022 What is Nagios?\n \u2022 The Code\n \u2022 Challenge Accepted\n \u2022 What are we trying to achieve?\n \u2022 Step 1: RCE on Nagios XI server from low privilege Nagios XI user (CVE-2020-28648)\n \u2022 Step 2: Elevate privileges to \u2018root\u2019 on Nagios XI server (CVE-2020-28910)\n \u2022 Step 3: Trigger XSS by tainting data returned to Nagios Fusion from XI (CVE-2020-28903)\n \u2022 Step 4: Authenticated remote code execution on Nagios Fusion (CVE-2020-28905)\n \u2022 Step 5: Elevate privileges from apache to root using the \u2018cmd_subsys.php\u2019 (CVE-2020-28902)\n \u2022 Step 6: Get list of \u201cfused\u201d XI servers and exploit them using Step 1 and 2\n \u2022 PoC or Attack Platform\n \u2022 SoyGun\n \u2022 Command & Control (C2)\n \u2022 SoyGun Implant\n \u2022 DeadDrop\n \u2022 Demo\n \u2022 Disclosure and Afterthoughts\n \u2022 Full Vulnerabilities List\n\nhttps://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/", "creation_timestamp": "2021-05-27T17:17:10.000000Z"}, {"uuid": "220b61ab-87b8-47bc-b932-f079f1fc4cd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28910", "type": "published-proof-of-concept", "source": "Telegram/Ss44dfktnvBrSYmi5h3Hi4YxlnzSVf_TwVt3ct0JZrIkPN4", "content": "", "creation_timestamp": "2021-05-24T20:42:39.000000Z"}, {"uuid": "8c5e3fa8-bb2b-4a53-a963-b4631d53cdfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28918", "type": "seen", "source": "https://t.me/cibsecurity/23679", "content": "\u203c CVE-2020-28918 \u203c\n\nDualShield 5.9.8.0821 allows username enumeration on its login form. A valid username results in prompting for the password, whereas an invalid one will produce an \"unknown username\" error message.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-16T22:48:12.000000Z"}, {"uuid": "a1fc2ae1-a8c3-438f-8c92-fc9a993affab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28915", "type": "seen", "source": "https://t.me/cibsecurity/17367", "content": "\u203c CVE-2020-28915 \u203c\n\nA buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-09T05:25:05.000000Z"}, {"uuid": "90276c76-0057-4f6d-b45b-3a47f2fafa66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28916", "type": "seen", "source": "https://t.me/cibsecurity/17144", "content": "\u203c CVE-2020-28916 \u203c\n\nhw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-04T12:26:59.000000Z"}, {"uuid": "dc19982b-2a33-402e-af6f-135a636baefc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28914", "type": "seen", "source": "https://t.me/cibsecurity/16488", "content": "\u203c CVE-2020-28914 \u203c\n\nAn improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-18T00:39:35.000000Z"}, {"uuid": "d3186348-253c-459d-990b-693c9b7d9296", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28917", "type": "seen", "source": "https://t.me/cibsecurity/16494", "content": "\u203c CVE-2020-28917 \u203c\n\nAn issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-18T12:40:06.000000Z"}, {"uuid": "1ccc31db-366a-48af-a9dc-a1cc676331fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28915", "type": "seen", "source": "https://t.me/cibsecurity/16495", "content": "\u203c CVE-2020-28915 \u203c\n\nA buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-18T12:40:07.000000Z"}]}