Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.207)

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.207 advisory. - In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c...

PoC Exploit Released for Critical VMware Aria's SSH Auth Bypass Vulnerability

Proof-of-concept PoC exploit code has been made available for a recently disclosed and patched critical flaw impacting VMware Aria Operations for Networks formerly vRealize Network Insight. The flaw, tracked as CVE-2023-34039, is rated 9.8 out of a maximum of 10 for severity and has been describe...

CVE-2020-22612

Installer RCE on settings file write in MyBB before 1.8.22...

Code injection

Installer RCE on settings file write in MyBB before 1.8.22...

MyBB Security Vulnerabilities

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use, supports multiple languages, scalable and so on. A security vulnerability exists in MyBB that originates from allowing attackers to perform Remote Code Execution RC...

CVE-2020-22612

CVE-2020-22612 affects MyBB prior to 1.8.22. The issue is an Installer Remote Code Execution (RCE) vulnerability caused by settings file writes during installation. Impact is high (RCE via installer) as described in multiple sources. The only remediation provided in the connected documents is to ...

CVE-2020-22612

Installer RCE on settings file write in MyBB before 1.8.22...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip due to improper input sanitization in the unzipFile function which allows an attacker to exploit this vulnerability by using a crafted zip file. Details It is exploited using a...

Directory Traversal

Overview weichsel/ZIPFoundation is an Effortless ZIP Handling in Swift. Affected versions of this package are vulnerable to Directory Traversal via extracting a crafted zip file, allowing attackers to write files outside the extraction directory. Details A Directory Traversal attack also known as...

VMWare Aria Operations for Networks Multiple Vulnerabilities (VMSA-2023-0018)

According to its self-reported version, the instance of VMWare Aria Operations for Networks running on the remote web server is 6.x 6.2.0.1688977536, 6.3.x 6.3.0.1688986302, 6.4.x 6.4.0.1689079386, 6.5.x 6.5.1.1688974096, 6.6.x 6.6.0.1688979729, 6.7.x 6.7.0.1688972173, 6.8.x 6.8.0.1688989059, 6.9...

Critical Vulnerability Alert: VMware Aria Operations Networks at Risk from Remote Attacks

VMware has released software updates to correct two security vulnerabilities in Aria Operations for Networks that could be potentially exploited to bypass authentication and gain remote code execution. The most severe of the flaws is CVE-2023-34039 CVSS score: 9.8, which relates to a case of...

Race condition

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition...

CVE-2023-3252

CVE-2023-3252 affects Tenable Nessus prior to 10.5.5, where an authenticated, remote attacker with administrator privileges could modify logging variables to write arbitrary files on the remote host, causing a denial of service. The vulnerability is addressed in Nessus 10.5.5 (per TNS-2023-31). R...

CVE-2023-3252 Arbitrary File Write

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition...

CVE-2023-3252 Arbitrary File Write

An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition...

CVE-2023-20890

Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code execution...

CVE-2023-20890

Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code execution...

Remote code execution

Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code execution...

CVE-2023-20890

VMware Aria Operations for Networks is affected by CVE-2023-20890, an arbitrary file write vulnerability that authenticated administrators can abuse to write files to arbitrary locations and achieve remote code execution. Nessus plugin confirms multiple affected 6.x versions; VMware has released ...

CVE-2023-20890

Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to VMware Aria Operations for Networks can write files to arbitrary locations resulting in remote code execution...