Remote Control Collection Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Remote Control Collection RCE', 'Description' = %q This module utilizes the Remote Control Server's, part of the Remote Control Collection by...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Sysstat vulnerability (USN-5748-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5748-1 advisory. It was discovered that Sysstat incorrectly handled certain arithmetic multiplications. An attacker could use this issue to cause Sysstat t...

Remote Control Collection Remote Code Execution Exploit

This Metasploit module utilizes the Remote Control Server's protocol to deploy a payload and run it from the server. Remote Control Collection by Steppschuh version 3.1.1.12 was tested and affected at the time of the module writing. This module requires Metasploit: https://metasploit.com/download...

Important: Red Hat Security Advisory: Red Hat Fuse 7.11.1 release and security update

A minor version update from 7.11 to 7.11.1 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

InPost Gallery < 2.1.4.1 - Unauthenticated LFI to RCE

The plugin insecurely uses PHP's extract function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers. PoC Invoke the following shell commands to disclose the /etc/passwd file: Define the payload "pagepath"...

Updated xterm packages fix security vulnerability

xterm before patch 375 can enable an RCE under certain conditions...

Microsoft Patch Tuesday November 2022: Exchange ProxyNotShell RCE, JScript9, MoTW, OpenSSL, Edge, CNG, Print Spooler

Hello everyone! This episode will be about Microsoft Patch Tuesday for November 2022, including vulnerabilities that were added between October and November Patch Tuesdays. As usual, I use my open source Vulristics project to create the report. Alternative video link for Russia: The most importan...

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

CVE-2022-39197 RCE POC Reference Links https://mp...

CVE-2022-4136

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method...

Security feature bypass

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method...

CVE-2022-4136

CVE-2022-4136 affects qmpass/leadshop v1.4.15. The vulnerability arises from leadshop.php using call_user_func_array with GET-supplied include, data, and meta, enabling an attacker to invoke arbitrary functions (e.g., HttpGet, ToMkdir, UpdateSql, DownloadFile, RemoveDir) and potentially execute c...

CVE-2022-4136 Exposed Dangerous Method or Function in qmpaas/leadshop

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method...

Remote code execution

dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution RCE via filemanagecontrol.php...

Remote code execution

A remote code execution RCE vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE remote code execution on the attacked system running Optica. The vulnerability was patched in v...

CVE-2022-41922

yiisoft/yii before version 1.1.27 are vulnerable to Remote Code Execution RCE if the application calls unserialize on arbitrary user input. This has been patched in 1.1.27...

CVE-2020-23584

Summary: CVE-2020-23584 affects the OPTILINK OP-XT71000N (Hardware Version V2.2). An unauthenticated attacker can trigger remote code execution by sending crafted input in the PingTest parameter, exploiting a command-injection flaw via the IP-ADDRESS field using the pipe character (" | ") to targ...

CVE-2022-41922

The CVE-2022-41922 entry affects the PHP framework yiisoft/yii. Prior to version 1.1.27, applications that call unserialize() on arbitrary user input are vulnerable to Remote Code Execution. The issue has been patched in 1.1.27. The vulnerability carries a high/critical impact potential per multi...

CVE-2022-41875

Optica prior to version 0.10.2 is affected by a remote code execution (RCE) vulnerability triggered by specially crafted JSON payloads. The underlying issue involves unsafe deserialization via the Ruby JSON library oj.load; the fix moves to oj.safe_load in version 0.10.2, mitigating the RCE risk....

CVE-2022-44118

dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution RCE via filemanagecontrol.php...

ZoneMinder < 1.36.13 Multiple Vulnerabilities

ZoneMinder is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zoneminder:zoneminder"; if...