13253 matches found
Path traversal
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios...
CVE-2021-37343
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios...
CVE-2021-37343
Nagios XI
CVE-2021-37344
CVE-2021-37344 affects Nagios XI Switch Wizard prior to version 2.5.7, with remote code execution via OS command injection caused by improper neutralization of special elements in OS commands. Affected product: Nagios XI Switch Wizard (Nagios XI platform). Root cause: improper filtering of specia...
easy-mock 1.6.0 - Remote Code Execution (Authenticated) Exploit
Exploit Title: easy-mock 1.6.0 - Remote Code Execution RCE Authenticated Exploit Author: LionTree Vendor Homepage: https://github.com/easy-mock Software Link: https://github.com/easy-mock/easy-mock Version: 1.5.0-1.6.0 Tested on: windows 10node v8.17.0 import requests import json import random...
Adobe InDesign RCE Vulnerabilities (APSB21-22) - Windows
The host is missing an important security update according to Adobe August update. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2021-26424
The CVE-2021-26424 issue is a Windows TCP/IP remote code execution vulnerability. According to the NCSC advisory, it can be remotely triggered by a malicious IPv6 ping from a Hyper‑V guest to the Hyper‑V host, with exploitation achieved by sending a specially crafted TCP/IP packet to the host usi...
CVE-2021-22931
A flaw was found in Node.js. These vulnerabilities include remote code execution, Cross-site scripting XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library, which can lead to the output of wrong hostnames leading to Domai...
Microsoft Warns of Another Unpatched Windows Print Spooler RCE Vulnerability
A day after releasing Patch Tuesday updates, Microsoft acknowledged yet another remote code execution vulnerability in the Windows Print Spooler component, adding that it's working to remediate the issue in an upcoming security update. Tracked as CVE-2021-36958 CVSS score: 7.3, the unpatched flaw...
Atlassian Crowd pdkinstall Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE', 'Description' = %q This module can be used to upload a plugin on Atlassian Cloud v...
Cisco Firepower Device Manager On-Box Software RCE (cisco-sa-fdm-rce-Rx6vVurq)
According to its self-reported version, Cisco Firepower Device Manager FDM On-Box software is affected by a vulnerability in the REST API that allows an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to...
PrintNightmare and RDP RCE among major issues tackled by Patch Tuesday
The sheer number of patches 44 security vulnerabilities should be enough to scare us, but unfortunately we have gotten used to those numbers. In fact, 44 is a low number compared to what we have seen on recent Patch Tuesdays. So what are the most notable vulnerabilities that were patched. One...
KLA12282 RCE vulnerability in Microsoft Products (ESU)
A remote code execution vulnerability was found in Microsoft Products Extended Security Update. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-36958 Related products Windows-Print-Spooler CVE list CVE-2021-36958 unknown KB list 5005633 50056...
Chamilo LMS < 1.11.16 Multiple Vulnerabilities
Chamilo LMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:chamilo:chamilolms"; if...
Microsoft Office 365 (2016 Click-to-Run) Multiple RCE Vulnerabilities (Aug 2021)
This host is missing a critical security update according to Microsoft Office Click-to-Run updates. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Microsoft Windows Defender Multiple RCE Vulnerabilities (Jul 2021)
This host is missing a critical security update according to Microsoft Security Updates released for Microsoft Windows Defender Protection Engine dated 13-07-2021. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...
Microsoft Exchange Server RCE (ProxyShell)
Binary data exchangeproxyshell.nbin...
Remote Desktop Client RCE Vulnerability - Windows
Remote Desktop Client is prone to RCE vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
The top 3 OWASP risks to the financial services sector in 2021 and how to mitigate them
The Open Web Application Security Project OWASP is a non-profit organization that helps security experts protect web applications from cyber attacks. OWASP counts 32,000 volunteers worldwide who perform security assessments and conduct research on cybersecurity threats about which the larger...
