87 matches found
CVE-2022-2551
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating...
CVE-2022-2551
CVE-2022-2551 affects WordPress Duplicator plugin versions prior to 1.4.7. The vulnerability is an authentication bypass that causes the plugin to disclose the backup URL to unauthenticated users who access the main installer endpoint, enabling download of the full site backup without authenticat...
CVE-2022-2551 Duplicator < 1.4.7 - Unauthenticated Backup Download
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating...
WordPress Duplicator 1.4.6 Plugin - Unauthenticated Backup Download Vulnerability
Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download Exploit Author: SecuriTrust Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: 1.4.7 Tested on: Linux, Windows CVE : CVE-2022-2551 Reference:...
WordPress Duplicator 1.4.6 Backup Disclosure
Exploit Title: WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download Google Dork: N/A Date: 07.27.2022 Exploit Author: SecuriTrust Vendor Homepage: https://snapcreek.com/ Software Link: https://wordpress.org/plugins/duplicator/ Version: 1.4.7 Tested on: Linux, Windows CVE :...
211.233.41.237 Cross Site Scripting vulnerability OBB-2638668
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
webmail.rebacaneife.com.br Cross Site Scripting vulnerability OBB-2341715
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
VulnCheck KEV: CVE-2008-2551
The DownloaderActiveX Control DownloaderActiveX.ocx in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to force the download and execution of arbitrary files via a URL in the propDownloadUrl parameter with the propPostDownloadAction parameter set to "run."...
Debian DLA-2551-1 : slirp security update
Two issues have been found in slirp, a SLIP/PPP emulator using a dial up shell account. CVE-2020-7039 Due to mismanagement of memory, a heap-based buffer overflow or other out-of-bounds access might happen, which can lead to a DoS or potential execute arbitrary code. CVE-2020-8608 Prevent a buffe...
Exploit for CVE-2020-2551
WebLogic-CVE-2020-2551-To-Internet CVE-2020-2551: POC fo...
Exploit for CVE-2020-2551
CVE-2020-2551 Weblogic IIOP 反序列化 测试环境 Weblogic10.3.6+jdk1.6 打包好的jar包 提取码：a6ob 漏洞利用 下载jar包，然后使用marshalsec起一个恶意的RMI服务，本地编译一个exp.java java package payload; import java.io.IOException; public class exp public exp String cmd = "curl http://172.16.1.1/success"; try...
Exploit for CVE-2020-2551
weblogicPoc WebLogic Vuln POC: EXP cve-2020-2551, cve-2020-2...
CVE-2020-2551
creationtimestamp| type| source ---|---|--- 2020-01-21 19:54:53+00:00| seen| https://t.me/HackerOne/2598 2021-03-27 21:09:01+00:00| seen| https://t.me/reconshell/599 2021-09-05 16:58:17+00:00| published-proof-of-concept| https://t.me/infosec1z/47 2023-01-06 07:19:03+00:00|...
Exploit for CVE-2020-2551
Twitter: @Hktalent3135773...
CVE-2020-2551
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: WLS Core Components. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP...
CVE-2020-2551
CVE-2020-2551 affects Oracle WebLogic Server (WLS Core Components) on versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. The issue is a deserialization vulnerability in the IIOP protocol that allows an unauthenticated, network-remote attacker to take over the WebLogic Server. The CVSS 3....
CVE-2019-2551
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite subcomponent: Print Server. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker...
CVE-2019-2551
CVE-2019-2551 affects Oracle E-Business Suite One-to-One Fulfillment (Print Server). Affected versions include 12.1.1–12.2.8. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise One-to-One Fulfillment, with human interaction required for exploitation; i...
Drive-by download campaign targets Chinese websites, experiments with exploits
During our web crawls we sometimes come across bizarre findings or patterns we haven't seen before. This was the case with a particular drive-by download attack planted on Chinese websites. While by no means advanced it turned out to be fairly buggy, we witnessed a threat actor experimenting with...
CVE-2017-2551
The CVE concerns the WordPress BackWPup plugin, versions prior to 3.4.2, which allows brute-force download of backup files. Affected component: BackWPup WordPress plugin; root cause is a vulnerability enabling unauthorized retrieval of backups over the network. Impact: potential exposure of backu...