CVE-2024-4040 exploited in the wild: everything you need to know

Detect and mitigate CVE-2024-4040, a critical vulnerability in CrushFTP exploited in the wild. Organizations should patch urgently...

Unauthenticated CrushFTP Zero-Day Enables Complete Server Compromise

Rapid7 vulnerability researcher Ryan Emmons contributed to this blog. On Friday, April 19, 2024, managed file transfer vendor CrushFTP released information to a private mailing list on a new zero-day vulnerability affecting versions below 10.7.1 and 11.1.0 as well as legacy 9.x versions across al...

CVE-2024-4040

creationtimestamp| type| source ---|---|--- 2024-04-23 12:01:56+00:00| seen| https://t.me/ctinow/216024 2024-04-23 12:36:17+00:00| published-proof-of-concept| https://t.me/CNArsenal/2367 2024-04-24 08:26:14+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7154 2024-04-24...

Exploit for Code Injection in Crushftp

CVE-2024-4040 - exploit scanners This repository contains fil...

CVE-2024-4040

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code...

CVE-2024-4040 Unauthenticated arbitrary file read and remote code execution in CrushFTP

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code...

CVE-2024-4040 Unauthenticated arbitrary file read and remote code execution in CrushFTP

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code...

CVE-2024-4040

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code...

CVE-2023-4040

The CVE-2023-4040 issue affects the Stripe Payment Plugin for WooCommerce for WordPress. It stems from a missing capability check in the eh_callback_handler function in versions up to and including 3.7.9, enabling unauthenticated attackers to modify the status of arbitrary WooCommerce orders. The...

WordPress Stripe Payment Gateway for WooCommerce Plugin <= 3.7.9 is vulnerable to Broken Access Control

Software Stripe Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 3.7.9 Fixed in 3.8.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4040 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 44ff3f2a12c3 Credits Frances...

SUSE CVE-2007-0005

Multiple buffer overflows in the 1 read and 2 write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 allow local users to gain privileges...

SUSE CVE-2010-4040

Google Chrome before 7.0.517.41 does not properly handle animated GIF images, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a crafted image...

多款Kyocera产品跨站脚本漏洞

The Kyocera ECOSYS Series and Kyocera FS Series are both a series of printers from Kyocera Japan. A security vulnerability exists in the Kyocera MFP 4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN versions, which can be exploited by an attacker to inject arbitrary scripts...

Ubuntu: Security Advisory (USN-4040-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-4040

creationtimestamp| type| source ---|---|--- 2022-08-24 20:23:03+00:00| seen| https://t.me/cibsecurity/48668...

CVE-2021-4040

CVE-2021-4040 affects AMQ Broker / Red Hat AMQ Broker where a malformed message can trigger an Out-of-Memory condition, partially disrupting availability. The issue is cited in multiple sources (e.g., GHSA advisory and RHSA-2022:5101) describing a partial DoS via OOM without full compromise. Red ...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.10.0 release and security update

Red Hat AMQ Broker 7.10.0 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Advisory ROSA-SA-2021-1809

Software: bolt 0.7 OS: Cobalt 7.9 CVE-ID: CVE-2015-7309 CVE-Crit: HIGH CVE-DESC: The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, allowing remote authenticated users to execute arbitrary code by renaming a created file and then directly accessing it...

SUSE: Security Advisory (SUSE-SU-2014:1211-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2015:0232-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...