13283 matches found
CVE-2021-22720
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in C-Bus Toolkit V1.15.7 and prior that could allow a remote code execution when restoring a project...
New NAME:WRECK Vulnerabilities Impact Nearly 100 Million IoT Devices
Security researchers have uncovered nine vulnerabilities affecting four TCP/IP stacks impacting more than 100 million consumer and enterprise devices that could be exploited by an attacker to take control of a vulnerable system. Dubbed "NAME:WRECK" by Forescout and JSOF, the flaws are the latest ...
Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager
CVE-2020-5902 Auto exploit...
RCE Exploit Released for Unpatched Chrome, Opera, and Brave Browsers
An Indian security researcher has publicly published a proof-of-concept PoC exploit code for a newly discovered flaw impacting Google Chrome and other Chromium-based browsers like Microsoft Edge, Opera, and Brave. Released by Rajvardhan Agarwal, the working exploit concerns a remote code executio...
KLA12146 RCE vulnerability in Microsoft Developer tools
A remote code execution vulnerability was found in Microsoft Developer tools. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2021-28448 Related products Microsoft-Visual-Studio CVE list CVE-2021-28448 critical KB list Solution Install necessary...
Huawei EulerOS: Security Advisory for python-paramiko (EulerOS-SA-2021-1734)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for python-paramiko (EulerOS-SA-2021-1761)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cockpit CMS NoSQLi to RCE
This module exploits two NoSQLi vulnerabilities to retrieve the user list, and password reset tokens from the system. Next, the USER is targetted to reset their password. Then a command injection vulnerability is used to execute the payload. While it is possible to upload a payload and execute it...
Google Android April 2021 Security Patch Vulnerabilities: Discover and Take Remote Response Action Using VMDR for Mobile Devices
The recently released Android Security Bulletin for April 2021 addresses 36 vulnerabilities, out of which 2 are rated as critical vulnerabilities. The vulnerabilities affect open-source components such as the Android Framework, Android Media Framework, Android System, and Android’s Linux Kernel...
CVE-2021-24224
The EFBPverifyuploadfile AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE...
CVE-2021-24222
The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the formCadastro is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction,...
Default credentials
The EFBPverifyuploadfile AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE...
Design/Logic Flaw
The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the formCadastro is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction,...
CVE-2021-24224
Vulnerability summary (CVE-2021-24224) : The Easy Form Builder WordPress plugin (≤ 1.0) allows authenticated users to upload arbitrary files through the EFBP_verify_upload_file AJAX action. The upload verification lacks security checks, enabling low-privilege users to upload arbitrary files and p...
CVE-2021-24224 Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload
The EFBPverifyuploadfile AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE...
CVE-2021-24223 N5 Upload Form <= 1.0 - Unauthenticated Arbitrary File Upload to RCE
The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5uniqidrand, however, in the case of misconfigured servers...
CVE-2021-24222 WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE
The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the formCadastro is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction,...
CVE-2021-24222
The CVE-2021-24222 entry concerns the WP-Curriculo Vitae Free WordPress plugin (up to v6.3). The vulnerability is an unauthenticated arbitrary file upload via the page containing the [formCadastro] form, where users can submit files for profile pictures and resumes without file extension restrict...
CVE-2021-23369
CVE-2021-23369 affects handlebars.js prior to 4.7.7. It allows remote code execution when compiling templates from untrusted sources due to how certain compiling options are handled. The vulnerability is described in vendor advisories (e.g., IBM bulletin referencing Node.js handlebars module) and...
