SaltStack Salt Master Server Root Key Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SaltStack Salt Master Server Root Key Disclosure', 'Description' = %q This module exploits unauthenticated access to the prepauthinfo method in t...

CVE-2024-28328

CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format...

CVE-2024-31442

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command...

CVE-2024-31442 Redon-Hub has incorrect permissions on all admin related commands

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command...

CVE-2024-31442 Redon-Hub has incorrect permissions on all admin related commands

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command...

CVE-2024-31442

CVE-2024-31442 concerns Redon Hub, a Roblox Product Delivery Bot. Pre-1.0.2 versions permit all users to execute admin commands due to a permissions misconfiguration, allowing actions like receiving products for free and deleting/creating/updating products and tags. The only non-affected command ...

CVE-2024-31442

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command...

PT-2024-24079

Name of the Vulnerable Software and Affected Versions Redon Hub versions prior to 1.0.2 Description The issue affects Redon Hub, a Roblox Product Delivery Bot. In affected versions, all commands can be executed by all users, including admin commands. This allows users to receive products for free...

CVE-2024-31442: Incorrect Default Permissions

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command...

PT-2024-20959 · Asus · Asus Download Master

Name of the Vulnerable Software and Affected Versions: ASUS Download Master affected versions not specified Description: The issue allows an attacker to execute commands in the context of the web server, running as admin. Recommendations: At the moment, there is no information about a newer versi...

CVE-2023-48646

Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings...

Vulnerability fixed in Ivanti MobileIron Sentry

Ivanti has fixed a vulnerability in MobileIron Sentry. A unauthenticated malicious person with access to the management interface could exploit the vulnerability to use API calls to manipulate the Sentry system and execute commands with administrator privileges. For successful misuse, the malicio...

GHSA-3PMJ-JQQP-2MJ3 matrix-appservice-irc IRC command injection via admin commands containing newlines

Impact It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Patches Versions 1.0.1 and above are patched. Workarounds There are no robust workaround...

matrix-appservice-irc IRC command injection via admin commands containing newlines

Impact It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Patches Versions 1.0.1 and above are patched. Workarounds There are no robust workaround...

CVE-2023-38690 matrix-appservice-irc IRC command injection via admin commands containing newlines

matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0....

PT-2023-4417 · Solarwinds · Solarwinds Orion Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform affected versions not specified Description: The issue is related to an incorrect comparison vulnerability in the UpdateActionsProperties method of the SolarWinds Orion Platform. This vulnerability allows a remote...

CVE-2023-33443

Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative commands via a crafted payload sent to the desired endpoints...

PT-2023-3000 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS Evolved versions prior to 20.4R3-S5-EVO Juniper Networks Junos OS Evolved 21.2 versions prior to 21.2R3-EVO Juniper Networks Junos OS Evolved 21.3 versions prior to 21.3R2-EVO Juniper Networks Junos OS Evolved 21.4...

Aztech WMB250AC command injection vulnerability

The Aztech WMB250AC is a wireless router from Aztech. A security vulnerability exists in the Aztech WMB250AC Mesh Routers Firmware version 016 2020 that stems from incorrectly managing sessions. An attacker could use the vulnerability to bypass authentication and execute arbitrary commands with...

Multiple Panasonic products have vulnerabilities related to cross-site request forgery attacks.

The Panasonic VCC-HD5600P, among others, is a surveillance camera from Panasonic Corporation Panasonic of Japan. A cross-site request forgery vulnerability exists in multiple Panasonic products, versions 1.02-05 and 2.03-0x, which stems from vulnerability to cross-site request forgery attacks. An...