MLFlow < 2.8.1 - Sensitive Information Disclosure

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. id: CVE-2023-43472 info: name: MLFlow 2.8.1 - Sensitive Information Disclosure author: ritikchaddha severity: high description: | An issue in MLFlow versions...

Progress Telerik Report Server - Authentication Bypass

In Progress Telerik Report Server, version 2024 Q1 10.0.24.305 or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability. id: CVE-2024-4358 info: name: Progress Telerik Report Server - Authenticatio...

APsystems ECU-R Firmware - Command Injection

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter. id: CVE-2022-45699 info: name: APsystems ECU-R Firmware - Command Injection author: pussycat0x severity:...

Juniper J-Web - Remote Code Execution

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands id: CVE-2023-36845 info: name: Juniper J-Web - Remote Code...

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

Cisco RV110W RV130W RV215W Router - Information leakage

A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForSingleFile endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

Exploit-PoC-para-CVE-2024-30085

🚨 Exploit PoC for CVE-2024-30085 Proof of Concept exploit for the CVE-2024-30085 privilege escalation vulnerability. For educational and security research purposes only. ⚠️ Legal Warning FOR EDUCATIONAL USE ONLY ✅ Authorized security research ✅ Controlled laboratories ✅ Cybersecurity education ❌...

Oracle Enterprise Manager Cloud Control 24.1 (October 2026 CPU)

The 24.1.0.0 version of Enterprise Manager Cloud Control installed on the remote host is affected by a vulnerability as referenced in the October 2026 CPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: API Gateway...

Copy-Fail_Detect_and_mitigate_CVE-2026-31431

Copy Fail - CVE-2026-31431 Detector and Mitigator Detect exposure to CVE-2026-31431 Copy Fail and optionally apply a host-level mitigation by disabling the algifaead kernel module on vulnerable systems. What this repo provides copyfail-check.sh — checks kernel patch status, runtime module exposur...

OverlayFS-PrivEsc-CVE-2022-0944

CVE-2022-0944: Privilege Escalation Vulnerability in OverlayFS 🛡️ Security advisory and mitigation guide for the Linux kernel privilege escalation vulnerability in OverlayFS. Overview CVE-2022-0944 is a security vulnerability in the Linux kernel's OverlayFS subsystem that allows local attackers to...

CockpitCMS-Arbitrary-File-Upload--XSS---Assets

Cockpit CMS 2.7.0 File Upload - XSS Author: Sergio Description: File upload vulnerability in Cockpit CMS 2.7.0 allows a local attacker to upload a pdf file with hidden XSS. Attack Vectors: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L POC: This is the software version. This is the content of the XSS inject...

honeypot

🍯 Honeypot Research Project What is a Honeypot A honeypot is a computer system or network that is intentionally left vulnerable to hackers in order to detect, analyse, and respond to potential security threats. The goal of a honeypot is to gather information about the tactics, techniques, and...

cve-2019-14220

Summary An unprotected method in a bstutils service in BlueStacks 4.120 and below on Mac and 4.110 and below on Winodws allows a local attacker to read the contents of arbitrary files with system privileges. Description BlueStacks is an Android emulator available for Windows and Mac systems. It...

Dropbear_CVE-2013-4434

DropbearCVE-2013-4434 dropbearCVE-2013-4434.sh This script checks for CVE-2013-4434 https://vulners.com/cve/CVE-2013-4434. Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows...

CVE-2020-0688

CVE-2020-0688 Microsoft Exchange Server Fixed Cryptographic Key Remote Code Execution RCE Instead of having randomly-generated keys on a per-installation basis, all installations of Microsoft Exchange Server have the same validationKey and decryptionKey values in web.config. Thus, an authenticate...

CVE-2023-43148

CVE-2023-43148 Author : Aitor Herrero Fuentes Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/admin Version: 1.9.0.3 Tested on: Windows 10 Pro CSRF DELETE ALL ACCOUNT Cross Site Request Forgery vulnerability in application demo.spa-cart.com allows ...

CVE-2024-51358

CVE-2024-51358: SSRF in Heimdall application A server-side request forgery SSRF vulnerability was discovered in Heimdall version 2.6.1, specifically within the Add Application feature. This flaw allows remote attackers to perform HTTP requests. References: Heimdall GitHub repository:...

EUVD-2026-106804

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications component: Security. Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the...