Giveaway <= 1.2.2 - Authenticated SQL Injection

The plugin is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary SQL commands via the $postid on the options.php page. PoC 1. Navigate in Wordpress panel to Settings - Giveaway 2. Intercept the request in Burp Suite 3. Click on "Select" button at the...

Remote Code Execution

fail2ban is vulnerable to remote code execution. The mailing action mail-whois command mail from mailutils package used in mail actions like mail-whois can execute command allows an attacker to execute arbitrary commands due to unescaped sequences \n in foreign input...

Aruba Instant (IAP) - Remote Code Execution Exploit

Aruba Instant IAP - Remote Code Execution Exploit import socket import sys import struct import time import threading import urllib3 import re import telnetlib import xml.etree.ElementTree as ET import requests urllib3.disablewarnings CONTINUERACE = True SNPRINTFCREATEFILEMAXLENGTH = 245 def...

Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection

Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection Date: 15.07.2021 Discovered by: Jeroen - IT Nerdbox Exploit Author: Metin Yunus Kandemir Version: sg2000-2000.1331 Vendor Homepage: https://www.seagate.com/ Software Link:...

openSUSE 15 Security Update : salt (openSUSE-SU-2021:2106-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2106-1 advisory. - Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to...

CVE-2021-20533

IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813...

Design/Logic Flaw

IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813...

CVE-2021-20533

IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813...

Cisco Web Security Appliance Privilege Escalation (cisco-sa-scr-web-priv-esc-k3HCGJZ)

According to its self-reported version, Cisco Web Security Appliance is affected by a privilege escalation vulnerability. A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injectio...

Liferay Portal 7.3.5 SQLi

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to 1 CommerceChannelRelFinder.countByCC, or 2 CommerceChannelRelFinder.findByCC. Note that Nessus has not tested for this issue but has...

Fortinet FortiSandbox 操作系统命令注入漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. Fortinet FortiSandbox suffers from a command injection vulnerability that...

Security Updates for Microsoft Dynamics 365 Business Central (July 2021)

The Microsoft Dynamics 365 Business Central install is missing a security update. It is, therefore, affected by a Remote Code Execution vulnerability. An authenticated attacker can exploit this, to execute arbitrary commands. Note that Nessus has not attempted to exploit this issue but has instea...

CVE-2021-26089

An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase...

CVE-2021-26089

An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase...

dotCMS Cross-Site Scripting Vulnerability (CNVD-2021-50942)

dotcms is a powerful Content Management System CMS developed in Java. A reflective cross-site scripting vulnerability exists in dotAdmin//c/links in dotCMS version 21.05.1, which can be exploited by an attacker to execute arbitrary commands or HTML...

Netgear WNAP320 Command Injection

A command injection vulnerability exists in Netgear WNAP320. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2021-35360

A reflected cross site scripting XSS vulnerability in dotAdmin//c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload...

CVE-2021-35361

A reflected cross site scripting XSS vulnerability in dotAdmin//c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload...

CVE-2021-35360

A reflected cross site scripting XSS vulnerability in dotAdmin//c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload...

Cross site scripting

A reflected cross site scripting XSS vulnerability in dotAdmin//c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload...