Exim <= 4.96.2 libspf2 RCE Vulnerability (Sep 2023)

Exim is prone to a remote code execution RCE vulnerability in the used libspf2 library. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Exploit for Race Condition in Microsoft

CVE-2023-36884: MS Office HTML RCE with crafted documents On...

CVE-2023-42116

Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling o...

CVE-2023-38874

CVE-2023-38874 affects Economizzer v0.9-beta1. The vulnerability is an insecure file upload that lets an attacker upload a PHP web shell as an attachment when adding a new cash book entry, then access the shell to execute arbitrary commands. This results in remote code execution (RCE) with high i...

JetBrains Patches Severe TeamCity Flaw Allowing RCE and Server Hijacking

By Deeba Ahmed JetBrains has fixed this flaw in version 2023.05.4 of the product released on September 18. It also released a security advisory but didn't disclose technical details of the vulnerability for now. This is a post from HackRead.com Read the original post: JetBrains Patches Severe...

JetBrains TeamCity < 2023.05.4 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2023.05.4. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible CVE-2023-42793 - In JetBrains TeamCity before...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-005)

The version of tomcat installed on the remote host is prior to 8.5.79-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-005 advisory. A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux,...

CVE-2023-5183 Authenticated RCE due to unsafe JSON deserialization

Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the networktraffic API endpoint. An attacker can leverage this vulnerability to execute...

CVE-2023-5183 Authenticated RCE due to unsafe JSON deserialization

Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the networktraffic API endpoint. An attacker can leverage this vulnerability to execute...

Exploit for PHP External Variable Modification in Juniper Junos

CVE-2023-36845 Description CVE-2023-36845 represen...

Exploit for CVE-2022-1040

CVE-2022-1040-sophos-rce-poc sophos rce poc sophos webmin po...

CVE-2023-43187

NodeBB

CVE-2023-43234

CVE-2023-43234 affects DedeBIZ v6.2.11. The vulnerability exists in the /admin/file_manage_control.php endpoint, exploitable via the $activepath and $filename parameters, enabling remote code execution. Multiple sources describe the root cause as improper handling/filtering of constructed snippet...

CVE-2023-43234

DedeBIZ v6.2.11 was discovered to contain multiple remote code execution RCE vulnerabilities at /admin/filemanagecontrol.php via the $activepath and $filename parameters...

CVE-2023-4521

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue...

CVE-2023-0625

Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0...

CVE-2023-0626

Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0...

Code injection

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue...

CVE-2023-4521 Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue...

CVE-2023-4521 Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue...