ManageEngine ServiceDesk Plus Remote Code Execution Exploit

This Metasploit module exploits CVE-2021-44077, an unauthenticated remote code execution vulnerability in ManageEngine ServiceDesk Plus, to upload an EXE msiexec.exe and execute it as the SYSTEM account. Note that build 11305 is vulnerable to the authentication bypass but not the file upload. The...

BusyBox Memory Leak Code Execution

The vulnerability of the BusyBox command-line utility set is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Google Android Input Validation Error Vulnerability (CNVD-2021-103432)

Google Android is a Linux-based open-source operating system from the U.S. company Google. Google Android is vulnerable to an input validation error, which can be exploited by attackers to cause a local privilege escalation that requires the user to execute privileges...

Security Bulletin: IBM Storage Support for Microsoft Volume Shadow Copy Service (VSS) and Virtual Disk Service (VDS) is affected by a vulnerability in Apache Log4j (CVE-2021-4104)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Storage Support for Microsoft Volume Shadow Copy Service VSS and Virtual Disk Service VDS for IBM Spectrum Virtualize family and IBM DS8000 family storage systems. This vulnerability has been addressed...

CVE-2017-13908: Undefined Security Weakness

An issue in handling file permissions was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, macOS High Sierra 10.13. A local attacker may be able to execute non-executable text files via ...

PT-2021-8558

Name of the Vulnerable Software and Affected Versions macOS High Sierra versions prior to 10.13.1 Security Update 2017-001 Sierra affected versions not specified Security Update 2017-004 El Capitan affected versions not specified Description A local attacker may exploit an issue in handling file...

Out-of-bounds

An out-of-bounds read vulnerability exists when reading a TIF file using Open Design Alliance Drawings SDK before 2022.12. The specific issue exists after loading TIF files. An unchecked input data from a crafted TIF file leads to an out-of-bounds read. An attacker can leverage this vulnerability...

Command injection

Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code...

CVE-2021-36336

Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execute code on the affected system...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Spectrum Copy Data Management (CVE-2021-44228)

Summary A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This vulnerability may affect the Help system in IBM Spectrum Copy Data Management Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execut...

CVE-2021-43439

CVE-2021-43439 : RCE in the Add Review Function of iResturant 1.0 allows a remote attacker to execute commands. The NVD entry lists CVSSv3.1 base score 9.8 (CRITICAL) with network access, no user interaction, and high confidentiality/integrity/availability impact. Connected documents provide cont...

Cross-Site Scripting (XSS)

gaoming13/wechat-php-sdk is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in serve function in 'Wechat.php', allowing an attacker to inject and execute malicious script...

CVE-2021-44164

The CVE-2021-44164 entry concerns Chain Sea AI chatbot system; its file upload function lacks robust filtering for special URL characters, allowing bypass of file type validation and remote code execution without authentication. Impact is system take-over or service termination as described; conn...

CVE-2021-44035

CVE-2021-44035 affects Wolters Kluwer TeamMate AM 12.4 Update 1. The vulnerability stems from mishandling of attachment uploads, enabling an authenticated user to download and execute malicious files. The available connected documents confirm the affected product and the root cause as described, ...

Security Bulletin: Log4JShell Vulnerability affects Watson Knowledge Catalog InstaScan (CVE-2021-44228)

Summary There is a vulnerability in the version of Apache Log4j that was included in Watson Knowledge Catalog InstaScan. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the...

POWER METER SICAM Q100 Remote Code Execution Vulnerability

The POWER METER SICAM Q100 is a multifunctional device used to detect, report and analyze measured values and events.The POWER METER SICAM Q100 remote code execution vulnerability can be exploited by remote attackers to execute remote code...

Adobe Premiere Rush Code Execution Vulnerability (CNVD-2021-101116)

Adobe Premiere Rush is a cross-platform video editing software from Adobe. Adobe Premiere Rush has a security vulnerability that could be exploited by attackers to execute arbitrary code on the system...

Adobe Premiere Rush Code Execution Vulnerability (CNVD-2021-101126)

Adobe Premiere Rush is a cross-platform video editing software from Adobe. Adobe Premiere Rush has a security vulnerability that could be exploited by attackers to execute arbitrary code on the system...

Bentley View JT File Parsing Stack Buffer Overflow Remote Code Execution Vulnerability

Bentley View is a free viewer from Bentley Systems, Inc. Bentley View JT file parsing stack buffer overflow remote code execution vulnerability is due to failure to properly validate the length of user-supplied data before copying it to the stack buffer. An attacker could exploit this vulnerabili...

CVE-2021-44437

A vulnerability has been identified in JT Utilities All versions V13.1.1.0, JTTK All versions V11.1.1.0. JTTK library in affected products is vulnerable to an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execu...