13198 matches found
Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager
CVE-2022-1388 RCE checker Simple bash script to check CVE-202...
Authenticated RCE through /admin/settings/email endpoint
Description Craftcms is vulnerable to Command Injection on the email settings, on the /admin/settings/email endpoint. An attacker can send a POST request with a specially crafted transportTypescraft\mail\transportadapters\Sendmailcommand= parameter to inject arbitrary commands that will be execut...
Remote Code Execution (RCE)
firefox is vulnerable to remote code execution. The vulnerability exists due to a memory corruption allowing an attacker to inject maliciously crafted script into the system...
CVE-2021-27760
The CVE-2021-27760 entry concerns HCL Notes 11.0–11.0.1 FP4 Sametime Embedded chat clients, where an authenticated Sametime chat user can trigger Remote Code Execution on another chat client by sending a specially formatted message containing Javascript code. The vulnerability arises in group cha...
Metasploit Wrap-Up
VMware Workspace ONE Access RCE Community contributor wvu has developed a new Metasploit Module which exploits CVE-2022-22954, an unauthenticated server-side template injection SSTI in VMware Workspace ONE Access, to execute shell commands as the ‘horizon’ user. This module has a CVSSv3 base scor...
CVE-2022-27784 Adobe After Effects Stack Buffer Overflow Could Lead To RCE
Adobe After Effects versions 22.2.1 and earlier and 18.4.5 and earlier are affected by a stack overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a...
CVE-2022-28005
CVE-2022-28005 affects the 3CX Phone System Management Console prior to version 18 Update 3 FINAL on Windows. It allows an unauthenticated attacker to traverse the server via /Electron/download with backslash-using path components, leading to cleartext credential disclosure; a subsequent authenti...
VMware Spring Cloud Function < 3.1.7, 3.2.x < 3.2.3 RCE Vulnerability - Active Check
VMware Spring Cloud Function is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...
CVE-2022-29171
Sourcegraph ≤ 3.37.0 is vulnerable to Remote Code Execution in the gitserver service. The Gitolite code-host integration with Phabricator lets an administrator who can edit/add a Gitolite code-host and has admin access to Sourcegraph’s bundled Grafana instance modify the callsignCommand, which ca...
RCE due to a dependency confusion
Description Hi team, I hope you are well. I found a dependency confusion vulnerability in this repo. When I analyzed your repo, I found a Makefile which install a dependency : https://github.com/bits-and-blooms/bloom/blob/25ba46ef8744ddeba999dcd048dbb8b0fa87edb3/MakefileL188 go get...
Grandstream Networks UCM6200 Series SQLi (SIP)
A SQL injection vulnerability exists in Grandstream UCM6200 Series devices. An unauthenticated, remote attacker can exploit this to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17. Note that Nessus has not tested...
Grandstream Networks UCM6200 Series SQLi (Web UI)
A SQL injection vulnerability exists in Grandstream UCM6200 Series devices. An unauthenticated, remote attacker can exploit this to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17. Note that Nessus has not tested...
CVE-2022-28568
Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored...
CVE-2022-28568
Sourcecodester Doctor's Appointment System 1.0 is affected by a File Upload to RCE vulnerability via image uploads from the administrator panel. The underlying issue is improper handling of uploaded image files, allowing remote command execution once the attacker can locate the image storage path...
Command injection
Seacms v11.6 was discovered to contain a remote command execution RCE vulnerability via the Mail Server Settings...
CVE-2022-28076
CVE-2022-28076 affects SeaCMS v11.6. The issue is a remote command execution (RCE) via the Mail Server Settings in SeaCMS’s code path. The connected records consistently describe SeaCMS 11.6 as vulnerable to RCE from mail server configuration, but do not provide precise technical details about th...
CVE-2022-28096
Skycaiji v2.4 was discovered to contain a remote code execution RCE vulnerability via /SkycaijiApp/admin/controller/Develop.php...
CVE-2022-28096
Skycaiji v2.4 contains a remote code execution (RCE) vulnerability reachable via the /SkycaijiApp/admin/controller/Develop.php endpoint. Multiple connected sources (NVD, Red Hat, CP advisories) confirm the RCE via this path; no patch/version fix is specified in the provided documents. PT Security...