13299 matches found
Prototype Pollution in x-extends/xe-utils
Description xe-utils is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js const set = require'xe-utils' console.log'Before: ', .polluted set, 'proto.polluted', true console.log'After: ', .polluted 2. Execute the following commands in the...
Gitea 1.7.5 Remote Code Execution
Exploit Title: Gitea 1.7.5 - Remote Code Execution Date: 2020-05-11 Exploit Author: 1F98D Original Author: LoRexxar Software Link: https://gitea.io/en-us/ Version: Gitea before 1.7.6 and 1.8.x before 1.8-RC3 Tested on: Debian 9.11 x64 CVE: CVE-2019-11229 References:...
Security update for kitty (important)
openSUSE Security Update: Security update for kitty Announcement ID: openSUSE-SU-2021:0025-1 Rating: important References: 1180298 Cross-References: CVE-2020-35605 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for kitty fix...
Gitea 1.7.5 - Remote Code Execution
Exploit Title: Gitea 1.7.5 - Remote Code Execution Date: 2020-05-11 Exploit Author: 1F98D Original Author: LoRexxar Software Link: https://gitea.io/en-us/ Version: Gitea before 1.7.6 and 1.8.x before 1.8-RC3 Tested on: Debian 9.11 x64 CVE: CVE-2019-11229 References:...
Resumes Management and Job Application Website 1.0 - RCE (Unauthenticated)
Exploit Title: Resumes Management and Job Application Website 1.0 - RCE Unauthenticated Date: 3/1/2021 Exploit Author: Arnav Tripathy Vendor Homepage: https://egavilanmedia.com Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/ Version: 1.0 Tested on:...
Responsive E-Learning System 1.0 Shell Upload
Exploit Title: Responsive E-Learning System 1.0 - Unrestricted File Upload to RCE Date: 2020-12-24 Exploit Author: Kshitiz Raj manitorpotterk Vendor Homepage: https://www.sourcecodester.com/php/5172/responsive-e-learning-system.html Software Link:...
CMS Made Simple 2.2.15 Remote Command Execution
Exploit Title: CMS Made Simple 2.2.15 - RCE Authenticated Author: Andrey Stoykov Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Version: 2.2.15 Tested on: Debian 10 LAMPP Exploit and Detailed Info:...
Online Learning Management System 1.0 Remote Command Execution
Exploit Title: Online Learning Management System 1.0 - RCE Authenticated Date: 01.01.2021 Exploit Author: Bedri Sertkaya Vendor Homepage: https://www.sourcecodester.com/php/7339/learning-management-system.html Software Link:...
CVE-2021-3007
Laminas-http
Valve: CS:GO Server -> Client RCE through OOB access in CSVCMsg_SplitScreen + Info leak in HTTP download
Title: CS:GO Server - Client RCE through OOB access in CSVCMsgSplitScreen + Info leak in HTTP download Scope: csgo.exe Weakness: Out-of-bounds Read Severity: Critical 9.6 Link: https://hackerone.com/reports/1070835 Date: 2021-01-04 00:22:02 +0000 By: @simonscannell Details: We managed to write an...
Rock RMS File Upload / Account Takeover / Information Disclosure
Title ========================= Multiple vulnerabilities found in Rock RMS including RCE and account takeover. A total of three CVEs were issued for the vulnerabilities CVE-2019-18641, CVE-2019-18642, CVE-2019-18643 Product Description ========================= Rock RMS is an open source CRM...
CMS Made Simple 2.2.15 - RCE (Authenticated)
Exploit Title: CMS Made Simple 2.2.15 - RCE Authenticated Author: Andrey Stoykov Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Version: 2.2.15 Tested on: Debian 10 LAMPP Exploit and Detailed Info:...
Resumes Management And Job Application Website 1.0 Shell Upload
Exploit Title: Resumes-management-and-job-application-website unauthenticated RCE Date: 3/1/2021 Exploit Author: Arnav Tripathy Vendor Homepage: https://egavilanmedia.com Software Link: https://egavilanmedia.com/resumes-management-and-job-application-website/ Version: 1.0 Tested on: linux/lamp...
MTN Group: RCE Apache Struts2 remote command execution (S2-045) on [wifi-partner.mtn.com.gh]
Summary: A Remote Code Execution vulnerability exists in Apache Struts2 when performing file upload based on Jakarta Multipart parser. It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value isn't valid an exception is thrown which is then used to...
Phabricator: Git flag injection leads to arbitrary file write
keyword : mongoose PoC 1. Login and generate API token 2. Create a repo and push several commits to phabricator 3. Execute diffusion api curl http://dev.localhost/api/diffusion.internal.gitrawdiffquery \ -d api.token=api-token \ -d commit=--output%3D/tmp/qqq \ -d repository=R2 4. qqq file will be...
Automattic: Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE]
Summary: Dear Team, Today when I trying to find bugs on happy tools I have found 2 domains below for staging environment - https://maildev.happytools.dev - https:// api.happytools.dev Two websites above ssl certificate was expired. But you can adjust your date-time to 02/02/2020 or before that ti...
GHSA-WMFG-55F9-J8HQ Server-Side Template Injection
Impact A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. This has been assigned CVE-2020-26282. Patches Effective Immediately, all users should upgrade ...
CVE-2020-26282 Template Injection in BrowserUp Proxy
BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was...
CVE-2020-26282
CVE-2020-26282 affects BrowserUp Proxy. A Server-Side Template Injection allows attackers to inject arbitrary Java EL expressions, enabling unauthenticated Remote Code Execution. This vulnerability is fixed in version 2.1.2; affected deployments should upgrade to 2.1.2+ to mitigate. The issue ari...
