11801 matches found
GHSA-VPXF-Q44G-W34W Sealos billing system permission control defect
Summary There is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account. sealos. io/v1/Payment, resulting in the ability to recharge any amount of 1 RMB. Details The reason is that sealos is in arrears. Egg pain, we can't create a terminal...
Exploit for Use After Free in Arm Avalon_Gpu_Kernel_Driver
Exploit for CVE-2022-46395 to run on FireTV 2nd gen Cube Thi...
Exploit for Use After Free in Arm Avalon_Gpu_Kernel_Driver
Exploit for CVE-2022-46395 to run on FireTV 3rd gen Cube Thi...
Exploit for Out-of-bounds Write in Microsoft
Since February 2022 was reported a new ransomware that appears t...
Exploit for Out-of-bounds Write in Microsoft
Since February 2022 was reported a new ransomware that appears t...
Coraza has potential denial of service vulnerability
Summary Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. Details https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.goL26-L29 The bodyprocessors of multipart uses...
Querlo Chatbot <= 1.2.4 - Stored Cross-Site Scripting
The plugin does not escape or sanitize chat messages, leading to a stored Cross-Site Scripting vulnerability. PoC Submit the following in the chat message: """ See the XSS in Querlo...
Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit Remote Code Execution Vulnerability
Title: Microsoft 365 MSO Version 2305 Build 16.0.16501.20074 64-bit Remote Code Execution Vulnerability Author: nu11secur1ty Date: 04.17.2023 Vendor: https://www.microsoft.com/ Software: https://www.microsoft.com/en-us/microsoft-365/ Reference:...
Microsoft Office Remote Code Execution
Title: Microsoft Office Remote Code Execution Vulnerability Author: nu11secur1ty Date: 04.17.2023 Vendor: https://www.microsoft.com/ Software: https://www.microsoft.com/en-us/microsoft-365/ Reference: https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/ CVE-2023-28285...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick
ImageMagick Arbitrary Read Files - CVE-2022-44268 This reposi...
Mars: Stored XSS + CSRF in "apellido" value
A stored cross-site scripting and cross-site request forgery vulnerability was discovered in the "apellido" value of a user profile updating form, allowing unauthorized changes to be made to user accounts...
GHSA-X49M-3CW7-GQ5Q jcvi vulnerable to Configuration Injection due to unsanitized user input
Summary A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. PoC The vulnerable code snippet is...
Exploit for CVE-2022-30136
CVE-2022-30136 Windows Network File System Remote e...
DOM Cross Side Scripting
Description Hello team, Recently i found that, DOM XSS on profile language field there is a DOM XSS Proof of Concept Video poc: https://screencast-o-matic.com/watch/c01067VBWlV Step: 1. Login as simple user 2. Click on settings and select profile tab. 3. Click on change language as 'english' and...
GHSA-8JXM-XP43-QH3Q Silver vulnerable to MitM attack against implants due to a cryptography vulnerability
Summary The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. Reserved CVE ID: CVE-2023-34758 Details Please see the PoC repo. PoC...
GHSA-47P7-XFCC-4PV9 php-imap vulnerable to RCE through a directory traversal vulnerability
Summary An unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability which results in a remote code execution vulnerability. Details An attacker can send an email with a malicious attachment to the inbox, which gets crawled with webklex/php-im...
Jobpilot 2.61 SQL Injection
Exploit Title: Jobpilot v2.61 - SQL Injection Date: 2023-06-17 Exploit Author: Ahmet Ümit BAYRAM Vendor: https://codecanyon.net/item/jobpilot-job-portal-laravel-script/37897822 Demo Site: https://jobpilot.templatecookie.com Tested on: Kali Linux CVE: N/A ----- PoC: SQLi ----- Parameter: long GET...
MStore API < 3.9.8 - Unauthenticated Blind SQLi
The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointment...
PrePost SEO <= 3.0 - Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting XSS attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Add XSS payload to plugin's "Account API key" setting: ...
URL Shortify < 1.7.0 - Admin+ Cross Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Navigate to "URL Shortify Settings Links"...