CVE-2022-32224

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record 7.0.3.1, 6.1.6.1, 6.0.5.1 and 5.2.8.1 which could allow an attacker, that can manipulate data in the database via means like SQL injection, the ability to escalate to an RCE...

Deserialization of Untrusted Data

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record 7.0.3.1, 6.1.6.1, 6.0.5.1 and 5.2.8.1 which could allow an attacker, that can manipulate data in the database via means like SQL injection, the ability to escalate to an RCE...

CVE-2022-32224

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record 7.0.3.1, 6.1.6.1, 6.0.5.1 and 5.2.8.1 which could allow an attacker, that can manipulate data in the database via means like SQL injection, the ability to escalate to an RCE...

Remote Code Execution (RCE)

nvidia-cuda-toolkit is vulnerable to remote code execution. The vulnerability exists due to an integer overflow which allows an attacker to inject and execute malicious input...

Metasploit Weekly Wrap-Up

ProxyNotShell This week's Metasploit release includes an exploit module for CVE-2022-41082, AKA ProxyNotShell by DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q, Orange Tsai, Piotr Bazydło, Rich Warren, Soroush Dalili, and our very own Spencer McIntyre. The vulnerability CVE-2022-41082, AKA ProxyNotShell is a...

ManageEngine ServiceDesk Plus MSP < 13.0 Build 13000 RCE

A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13000 due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. The option to integrate Zoho Analytics will no longer be availab...

Exploit for OS Command Injection in Contao

CVE-2022-26265 Contao CMS RCE This repo is part of the h...

CVE-2022-43333

Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution RCE vulnerability in the component actionexportcontrol.php...

ff4j is vulnerable to Remote Code Execution (RCE)

ff4j 1.8.1 is vulnerable to Remote Code Execution RCE. This issue has been patched in version 1.9...

CVE-2022-43333

Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution RCE vulnerability in the component actionexportcontrol.php...

CentOS: Security Advisory for hsqldb (CESA-2022:8560)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-44262

CVE-2022-44262 affects the FF4J library (ff4j) version 1.8.1, with confirmed Remote Code Execution (RCE) risk. Multiple sources (Red Hat, GHSA, OSV, NVD, CNNVD, PT-2022-27160) document this vulnerability and indicate it has been patched in version 1.9. The root cause details are not expanded in t...

CVE-2022-43333

CVE-2022-43333 affects Telenia Software s.r.l TVox prior to version 22.0.17. The vulnerability is a Remote Code Execution (RCE) in the component action_export_control.php. CVSSv3.1 base score is 9.8 (CRITICAL) with NETWORK attack vector, no privileges, no user interaction, and HIGH impacts to con...

hsqldb security update

CentOS Errata and Security Advisory CESA-2022:8560 An update for hsqldb is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Zenario CMS is vulnerable to Remote Code Execution (RCE).

Zenario CMS 9.3.57186 is vulnerable to RCE...

Adversaries strike critical Windows IKE flaw in the “Bleed You” campaign

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary An active "Bleed You" campaign is leveraging a critical RCE CVE-2022-34721 vulnerability in Windows Internet Key Exchange IKE Protocol Extensions to assist subsequent malware and ransomware assaults and...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 Checking and exploit for CVE-2022-1388...

CVE-2022-44136

Zenario CMS 9.3.57186 is affected by a Remote Code Execution (RCE) vulnerability. Multiple connected sources corroborate an RCE risk in this version of Zenario CMS, with public disclosures describing an attacker‑controlled code execution scenario and practical impact on systems running the affect...

Microsoft Exchange ProxyNotShell Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Exchange ProxyNotShell RCE', 'Description' = %q This module chains two vulnerabilities on Microsoft Exchange Server that, when combined...

CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a critical flaw impacting Oracle Fusion Middleware to its Known Exploited Vulnerabilities KEV Catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2021-35587, carries a CVSS score of 9.8 a...