Design/Logic Flaw

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin...

CVE-2020-7388

CVE-2020-7388 affects Sage X3 AdxAdmin/AdxDSrv.exe, allowing unauthenticated RCE as SYSTEM by editing the client authentication request. The flaw bypasses credential validation; attacker may need to know the installation path (information learnable via CVE-2020-7387). Root cause involves the logi...

CVE-2020-7388 Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing

Sage X3 Unauthenticated Remote Command Execution RCE as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by...

CVE-2020-7387

Sage X3 CVE-2020-7387 concerns an Installation Pathname Disclosure in AdxDSrv.exe. A crafted packet can trigger a response revealing the product installation directory. The vulnerability can be chained with CVE-2020-7388 to enable full RCE. Remediation: AdxAdmin 93.2.53 and associated updates for...

CVE-2020-7387 Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin...

CVE-2021-33032

CVE-2021-33032 is an RCE in the WebUI of eQ-3 HomeMatic CCU2/CCU3 firmware (<= 2.57.5/

RUSTSEC-2021-0077 `better-macro` has deliberate RCE to prove a point

better-macro is a fake crate which is "Proving A Point" that proc-macros can run arbitrary code. This is not a particularly novel or interesting observation. It currently opens https://github.com/raycar5/better-macro/blob/master/doc/hi.md which doesn't appear to have any malicious content, but...

`better-macro` has deliberate RCE to prove a point

better-macro is a fake crate which is "Proving A Point" that proc-macros can run arbitrary code. This is not a particularly novel or interesting observation. It currently opens https://github.com/raycar5/better-macro/blob/master/doc/hi.md which doesn't appear to have any malicious content, but...

Microsoft Exchange Server Unpublished Pre-Authentication Remote Code Execution Exploit

Description First, IT'S NOT PROXYLOGON. IT'S NOT PROXYLOGON. IT'S NOT PROXYLOGON. It's an unpublished vulnerability found by myself. It's not exploited in the wild and there's no exploit code on the Internet. About The Vulnerability It's a exploit chain utilizing pre-auth SSRF + post-auth EoP +...

Seagate BlackArmor NAS RCE Vulnerability (Jul 2021)

Seagate BlackArmor NAS is prone to a remote code execution RCE vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program i...

Dell OpenManage Enterprise docker实例预认证RCE认证绕过漏洞（CVE-2021-21596）

Details - Remote Auth Bypass with 2 pre-auth RCEs in docker instances There is a chain of pre-auth vulnerabilities allowing to: get a shell on the redis container, as redis get a shell on the postgres container, as postgres get a full access to the postgres database bypass authentication on the w...

Sage X3 Administration Service Authentication Bypass / Command Execution Exploit

This Metasploit module leverages an authentication bypass exploit within Sage X3 AdxSrv's administration protocol to execute arbitrary commands as SYSTEM against a Sage X3 Server running an available AdxAdmin service. This module requires Metasploit: https://metasploit.com/download Current source...

Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)

Exploit Title: Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery CSRF Date: 24/04/2021 Exploit Author: Mesh3l911 & Z0ldyck Vendor Homepage: https://www.webmin.com Repo Link: https://github.com/Mesh3l911/CVE-2021-31761 Version: Webmin 1.973 Tested on: All versions POC By \0331;m...

Unpatched iPhone Bug Allows Code Execution

A vulnerability in Apple iOS opens the door to remote code execution RCE, researchers found. The assessment is a revision from a previous understanding of the flaw that viewed it as a low-risk and somewhat wacky denial-of-service DoS problem affecting iPhone’s Wi-Fi feature. Apple fixed the...

CVE-2021-35963

The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks...

Format string

The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks...

CVE-2021-35963 Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type

The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthenticated attackers to upload files containing malicious script to execute RCE attacks...

CVE-2021-24453 Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure...

CVE-2021-24453

CVE-2021-24453 affects the WordPress plugin Include Me (versions up to 1.2.1). The flaw is a path traversal / local file inclusion (LFI) that can lead to Remote Code Execution (RCE) via log poisoning, potentially allowing full compromise of the underlying site. Affected detail: authenticated RCE ...

Turns Out That Low-Risk iOS Wi-Fi Naming Bug Can Hack iPhones Remotely

The Wi-Fi network name bug that was found to completely disable an iPhone's networking functionality had remote code execution capabilities and was silently fixed by Apple earlier this year, according to new research. The denial-of-service vulnerability, which came to light last month, stemmed fr...