ZDI-24-1057: Trimble SketchUp Pro SKP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

August 5, 2024

Read Time:17 Second

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trimble SketchUp Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2024-7511.

Advisories

DSA-5736-1 openjdk-11 – security update

August 5, 2024

Read Time:10 Second

Several vulnerabilities have been discovered in the OpenJDK Java runtime,
which may result in denial of service, information disclosure or bypass
of Java sandbox restrictions.

https://security-tracker.debian.org/tracker/DSA-5736-1

Advisories

DSA-5737-1 libreoffice – security update

August 5, 2024

Read Time:18 Second

If LibreOffice failed to validate a signed macro, it displayed a warning
but still allowed execution of the script after printing a warning.
Going forward in high macro security mode such macros are now disabled.

For additional information please refer to
https://www.libreoffice.org/about-us/security/advisories/cve-2024-6472/

https://security-tracker.debian.org/tracker/DSA-5737-1

Advisories

Blind SQL Injection – dolphinv7.4.2.

August 4, 2024

Read Time:23 Second

Posted by Andrey Stoykov on Aug 04

# Exploit Title: Blind SQL Injection – dolphinv7.4.2.
# Date: 8/2024
# Exploit Author: Andrey Stoykov
# Version: 7.4.2
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2024/07/friday-fun-pentest-series-8-dolphinv742.html

SQL Injection:

Steps to Reproduce:

1. Navigate to “Builders” menu
2. The HTTP GET parameter of “?cat=builders” is displayed in the URL bar
3. That is the injection point

sqlmap -r…

Advisories