8713 matches found
CVE-2021-3129
CVE-2021-3129 affects Laravel Ignition (and Laravel < 8.4.2) where insecure use of file_get_contents()/file_put_contents in debug mode allows unauthenticated RCE. Exploitable versions: Laravel Ignition < 2.5.2 and Laravel
CVE-2021-3129
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2. Recent assessments: ccondon-r7...
PT-2021-4652
Name of the Vulnerable Software and Affected Versions Laravel versions prior to 8.4.2 Ignition versions prior to 2.5.2 Description The issue is related to insecure usage of file get contents and file put contents in the Ignition library used by Laravel. This allows unauthenticated remote attacker...
PT-2021-11829 · Cacti +4 · Cacti +4
Name of the Vulnerable Software and Affected Versions: Cacti versions 1.2.x through 1.2.16 Description: A SQL injection issue in data debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site id parameter, potentially leading to remote code execution...
OPENSUSE-SU-2020:2301-1 Security update for gcc7
This update for gcc7 fixes the following issues: - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue bsc1172798 - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instructions...
OPENSUSE-SU-2020:2300-1 Security update for gcc7
This update for gcc7 fixes the following issues: - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue bsc1172798 - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instructions...
Security update for gcc7 (moderate)
openSUSE Security Update: Security update for gcc7 Announcement ID: openSUSE-SU-2020:2301-1 Rating: moderate References: 1150164 1161913 1167939 1172798 1178577 1178614 1178624 1178675 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.2 An update that solves one vulnerability a...
Security update for gcc7 (moderate)
openSUSE Security Update: Security update for gcc7 Announcement ID: openSUSE-SU-2020:2300-1 Rating: moderate References: 1150164 1161913 1167939 1172798 1178577 1178614 1178624 1178675 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability a...
WordPress Easy WP SMTP Password Reset
Wordpress plugin Easy WP SMTP versions use auxiliary/scanner/http/wpeasywpsmtp msf auxiliarywpeasywpsmtp show actions ...actions... msf auxiliarywpeasywpsmtp set ACTION msf auxiliarywpeasywpsmtp show options ...show and set options... msf auxiliarywpeasywpsmtp run This module requires Metasploit:...
RUSTSEC-2020-0127 SyncRef's clone() and debug() allow data races
Affected versions of this crate unconditionally implement Sync for SyncRef. This definition allows data races if &T is accessible through &SyncRef. SyncRef derives Clone and Debug, and the default implementations of those traits access &T by invoking T::clone & T::fmt. It is possible to create da...
SyncRef's clone() and debug() allow data races
Affected versions of this crate unconditionally implement Sync for SyncRef. This definition allows data races if &T is accessible through &SyncRef. SyncRef derives Clone and Debug, and the default implementations of those traits access &T by invoking T::clone & T::fmt. It is possible to create da...
WordPress easy-wp-smtp plugin log message disclosure vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A log information disclosure vulnerability exists in the WordPress easy-wp-smtp plugin prior to...
Easy WP SMTP Plugin for WordPress < 1.4.3 Debug Log Disclosure
The WordPress Easy WP SMTP Plugin installed on the remote host is affected by a debug log file disclosure that could allow an unauthenticated user to reset the admin password. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...
nxlog 2.10.2150 - Denial of Service Exploit
Exploit Title: nxlog 2.10.2150 - DoS Poc Exploit Author: Guillaume PETIT Vendor Homepage: https://nxlog.co Software Link: https://nxlog.co/products/nxlog-community-edition/download Version: 2.10.2150 Tested on: Linux Debian 10 && Windows Server 2019 !/usr/bin/python3 import sys import time import...
Nxlog Community Edition 2.10.2150 - DoS (Poc)
Exploit Title: Nxlog Community Edition 2.10.2150 - DoS Poc Date: 15/12/2020 Exploit Author: Guillaume PETIT Vendor Homepage: https://nxlog.co Software Link: https://nxlog.co/products/nxlog-community-edition/download Version: 2.10.2150 Tested on: Linux Debian 10 && Windows Server 2019 CVE:...
Ghost Framework - An Android Post-Exploitation Framework That Exploits The Android Debug Bridge To R emotely Access An Android Device
About Ghost Framework Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device. Ghost Framework gives you the power and convenience of remote Android device administration. Getting started Ghost installation To install...
Gitpaste-12 Worm Widens Set of Exploits in New Attacks
The Gitpaste-12 worm has returned in new attacks targeting web applications, IP cameras and routers, this time with an expanded set of exploits for initially compromising devices. First discovered in a round of late-October attacks that targeted Linux-based servers and internet-of-things IoT...
CVE-2020-35234
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file such as debuglog.txt that contains all password-reset link...
CVE-2020-35234
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file such as debuglog.txt that contains all password-reset link...
VulnCheck KEV: CVE-2020-35234
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file such as debuglog.txt that contains all...