From audit at gleg.net  Sat Oct  9 16:33:49 2021
From: audit at gleg.net (YG)
Date: Sat, 09 Oct 2021 16:33:49 -0000
Subject: [Canvas] Gleg Agora, SCADA, Def, ZDA updates
Message-ID: <20211009183354.Horde._nzPpVBy1DhJF1jzacZqfd2@gleg.net>


Dear colleagues, new modules available for download.

SCADA 2.18 :
  - ADLINK AD-Logger V1.20 Remote Code Execution Vulnerability. public
  - mySCADA myPRO 7 remote discover all ProjectID CVE-2018-11517
  - PROMOTIC SCADA v8.0.13 Remote Code Execution Vulnerability [1day] ActiveX
  - Pult Online v270 Information leak [0day]
  - SmartPTT Local File Inclusion [1Day]
  - SmartPTT SCADA 1.1.0.0 Remote Code Execution [1Day]
  - WiSCADA 2.0 Remote Arbitrary File Overwrite ActiveX unsafe [1Day]

Agora 3.17:
  - Websvn 2.6.0 Remote Code Execution CVE-2021-32305
  - osCommerce 2.3.4.1 Remote Code Execution pub
  - GLPI 9.5 Unauthenticated User Enumeration [1day]
  - GLPI 9.5 Unauthenticated User Enumeration [1day]
  - wordpress CVE-2021-29447 vuln
  - Citrix XenMobile Server Path Traversal Vulnerability CVE-2020-8209

DefPack 1.71:
  - Denver IP Camera SHO-110 Unauthenticated Snapshot. pub
  - F5 BIG-IP TMUI Directory Traversal Vulnerability CVE-2020-5902
  - PLANEX CS-QP50F-ING2 Security Surveillance Smart Camera Remote  
Configuration Disclosure . pub
  - Positive Technologies Maxpatrol 8 and Xspider Remote DoS. pub
  - Seagate BlackArmor NAS sg2000-2000.1331 Remote Code Execution. pub
  - TG8 Firewall Remote Code Execution. pub

ZDA 1.37 extra exploits:
  - Apache 2.4.49 Remote Code Execution CVE-2021-41773
  - Confluence Server 7.12.4 - Remote Code Execution (Unauthenticated)  
CVE-2021-26084
  - Gitlab 13.10.3 Unauthenticated User Enumeration. pub
  - PHPFusion 9.10.0 Arbitrary User Logout. pub
  - Xceed Software Zip for ActiveX File Create Vulnerability [0Day]

Happy pentesting,
Gleg Security team
Follow us on https://twitter.com/GlegExploitPack


From sales at d2sec.com  Fri Oct 22 07:05:30 2021
From: sales at d2sec.com (sales at d2sec.com)
Date: Fri, 22 Oct 2021 09:05:30 +0200
Subject: [Canvas] D2 Elliot 1.26, October 22 2021
Message-ID: <c9ed42959970c90541dd3cb3f0ce1180@d2sec.com>

D2 Elliot has been updated with 7 new web exploits. Payloads and 
workflows
have been improved.

Don't forget to follow us: https://twitter.com/d2sec


D2 Elliot Web Exploitation Framework is regularly updated with new 
exploits
and tools to keep a high level of efficiency. If you need customized 
exploits
or tools please contact us at info at d2sec.com

For sales inquiries and orders, please contact sales at d2sec.com

--
DSquare Security, LLC
Website: https://www.d2sec.com
Twitter: https://twitter.com/d2sec
YouTube: https://www.youtube.com/user/dsquaresecurity


Changelog:

Exploits - Added:
  E-734 - WordPress Asgaros Forum < 1.15.13 SQL Injection
  E-735 - Prestashop SmartBlog SQL Injection
  E-736 - Prestashop ph_simpleblog SQL Injection
  E-737 - Confluence < 7.12.3 File Disclosure
  E-738 - Apache 2.4.50 RCE
  E-739 - Apache 2.4.50 Path Traversal
  E-740 - WordPress DZS ZoomSounds < 6.50 File Disclosure