11707 matches found
CVE-2024-42767
Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/addroomcontroller.php...
SPIP 4.2.12 Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SPIP Unauthenticated RCE via porteplume Plugin', 'Description' = %q This module exploits a Remote Code Execution vulnerability in SPIP versions u...
CVE-2024-42767
Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/addroomcontroller.php...
GO-2022-1120 Tailscale Windows daemon is vulnerable to RCE via CSRF in tailscale.com
Tailscale Windows daemon is vulnerable to RCE via CSRF in tailscale.com...
Rocky Linux 8 : python3.12-setuptools (RLSA-2024:5531)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:5531 advisory. pypa/setuptools: Remote code execution via download functions in the packageindex module in pypa/setuptools CVE-2024-6345 Tenable has extracted the preceding...
WordPress Multilingual CMS Plugin <= 4.6.12 is vulnerable to Remote Code Execution (RCE)
Software Multilingual CMS Type Plugin Vulnerable versions = 4.6.12 Fixed in 4.6.13 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-6386 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 31c994cd7315 Credits stealthcopter Required...
CVE-2024-42362
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...
CVE-2024-42362
CVE-2024-42362 affects Hertzbeat, an open-source real-time monitoring system. It describes an authenticated (user role) remote-code-execution vulnerability via unsafe deserialization in /api/monitors/import. The issue is classified with a high impact (CVSS v3.1: 8.8) affecting confidentiality, in...
CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...
CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...
CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...
GO-2023-1961 Minikube RCE via DNS Rebinding in k8s.io/minikube
Minikube RCE via DNS Rebinding in k8s.io/minikube...
CVE-2024-42363 GHSL-2023-136_Samson
Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parsefile method where it is unsafely deserialized using the YAML.loadstream...
CVE-2024-42363
CVE-2024-42363 affects Samson (Zendesk open source web interface for deployment) prior to v3385. The issue stems from the user-controlled parameter “role” entering the Kubernetes::RoleVerificationsController, flowing into RoleConfigFile, then Kubernetes::Util.parse_file where YAML.load_stream des...
CVE-2024-21689
This High severity RCE Remote Code Execution vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to execute...
CVE-2024-21689
CVE-2024-21689 is a high-severity RCE in Atlassian Bamboo Data Center/Server, introduced in versions 9.1.0–9.6.0. An authenticated attacker can execute arbitrary code with high confidentiality, integrity, and availability impact, requiring user interaction. Public details indicate fixed upgrades:...
Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
Summary Upon reviewing the MobSF source code, I identified a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the...
Medium: ruby3.2
Issue Overview: ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Arbitrary memory address read vulnerability with Regex search CVE-2024-27282 Affected Packages: ruby3.2 Issue Correction: Run dnf update ruby3.2 --releasever 2023.5.20240819 to update your system. New Packages:...
Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2024-704)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-704 advisory. ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Arbitrary memory address read vulnerability with Regex search CVE-2024-27282 Tenable has extracted the preceding descripti...
