CVE-2023-49070 Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10...

CVE-2023-49070

CVE-2023-49070 is a pre-auth RCE in Apache OFBiz up to version 18.12.09, caused by an unused XML-RPC component that remains present. Affected product: Apache OFBiz before 18.12.10 (and related CVE-2023-51467 authentication-bypass vector). The severity is high (CVSS v3.1 base score 9.8) with netwo...

Exploit for CVE-2023-38646

CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabas...

Exploit for CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script w...

Exploit for CVE-2023-38646

CVE-2023-38646 The original script originates from securezer...

CVE-2023-38204 Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8

Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier and 2023u2 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction...

Exploit for CVE-2023-38646

CVE-2023-38646 - Metabase Pre-auth RCE !Untitled presentatio...

Exploit for CVE-2023-38646

For educational purposes only Inspired by Assetnote resea...

CVE-2023-38203 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction...

Exploit for Command Injection in Sophos Web_Appliance

Dork fofa title="Sophos Web Appliance" || app="Sophos-W...

Exploit for Path Traversal in Wso2 Api_Manager

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-2...

Exploit for Code Injection in Moodle

CVE-2021-36394-Pre-Auth-RCE-in-Moodle Vulnerability Introd...

Exploit for Path Traversal in Wso2 Api_Manager

WSO2 Carbon Server CVE-2022-29464 Pre-auth R...

Exploit for Path Traversal in Wso2 Api_Manager

WSO2 Carbon Server CVE-2022-29464 Pre-auth R...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

This is a PoC exploit for CVE-2021-26084, a pre-auth RCE injecti...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2021-26084 Proof of concept for CVE-2021-26084. Confluen...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2021-26084 CVE-2021-26084 - Confluence Pre-Auth RCE | O...

U.S. Dept Of Defense: Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)

RCE is possible thanks to unsafe Java deserialization in the Jato framework used by OpenAM. Impact An unauthenticated, 3rd-party attacker or adversary can execute remote code Supporting Material/References - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464 System...

Authorization

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue...

FiberHome HG6245D Disclosure / Bypass / Privilege Escalation / DoS

Hello, Please find a text-only version below sent to security mailing lists. The complete version on "Multiple vulnerabilities found in FiberHome HG6245D routers" is posted here: https://pierrekim.github.io/blog/2021-01-12-fiberhome-ont-0day-vulnerabilities.html === text-version of the advisory =...