Pulse Secure VPN Remote Code Execution Exploit

The Pulse Connect Secure appliance versions prior to 9.1R9 suffer from an uncontrolled gzip extraction vulnerability which allows an attacker to overwrite arbitrary files, resulting in remote code execution as root. Admin credentials are required for successful exploitation...

Remote Code Execution (RCE)

xstream is vulnerable to remote code execution RCE. The vulnerability exists through server-side request forgery when unmarshalling XStream objects with the java.beans.EventHandler, java.lang.ProcessBuilder, javax.imageio.ImageIO$ContainsFilter, and jdk.nashorn.internal.objects.NativeString class...

Linksys RE6500 1.0.11.001 Remote Code Execution

Exploit Title: Linksys RE6500 1.0.11.001 - Unauthenticated RCE Date: 31/07/2020 Exploit Author: RE-Solver Public disclosure: https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html4 Vendor Homepage: www.linksys.com Version: FW V1.05 up to FW v1.0.11.001 Tested on: F...

Linksys RE6500 1.0.11.001 - Unauthenticated RCE

Exploit Title: Linksys RE6500 1.0.11.001 - Unauthenticated RCE Date: 31/07/2020 Exploit Author: RE-Solver Public disclosure: https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html4 Vendor Homepage: www.linksys.com Version: FW V1.05 up to FW v1.0.11.001 Tested on: F...

Prototype Pollution in ionicabizau/obj-unflatten

Description obj-unflatten convert flatten objects in nested ones. This package is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: javascript // poc.js const unflatten = require'obj-unflatten' console.log'Before: ' + .polluted unflatten'proto.polluted':...

CVE-2019-14479

CVE-2019-14479 affects AdRem NetCrunch 10.6.0.4587. The vulnerability allows remote code execution via the NetCrunch web client, enabling a read-only administrator to run arbitrary code on the NetCrunch server software. The available connected documents confirm the affected product and the high-s...

Exploit for OS Command Injection in Sonatype Nexus_Repository_Manager

CVE-2019-5475 CVE-2019-5475 and CVE-2019-15588: RCE command...

Raysync 3.3.3.8 Remote Code Execution

Exploit Title: Raysync 3.3.3.8 - RCE Date: 04/10/2020 Exploit Author: XiaoLong Zhu Vendor Homepage: www.raysync.io Version: below 3.3.3.8 Tested on: Linux step1: run RaysyncServer.sh to build a web application on the local environment, set admin password to 123456 , which will be write to manage....

GitLab 11.4.7 - Remote Code Execution (Authenticated)

Exploit Title: GitLab 11.4.7 Authenticated Remote Code Execution No Interaction Required Date: 15th December 2020 Exploit Author: Mohin Paramasivam Shad0wQu35t Software Link: https://about.gitlab.com/ POC: https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/ Tested on...

CVE-2020-28072

A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE...

Remote code execution

A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE...

CVE-2020-28072

CVE-2020-28072 affects DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary PHP files via gallery.php and execute them on the server, achieving Remote Code Execution. Root cause is improper file upload handling enabling arbitrary file upload and execution. E...

FreeBSD : glpi -- Remote Code Execution (RCE) via the backup functionality (832fd11b-3b11-11eb-af2a-080027dbe4b7)

MITRE Corporation reports : In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only...

CVE-2020-25112

An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...

CVE-2020-24338

An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in picodnsdecompressname in picodnscommon.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds writ...

CVE-2020-25112

An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...

CVE-2020-25112

The CVE-2020-25112 entry corresponds to a memory-corruption vulnerability in Contiki’s uIP-Contiki-OS IPv6 stack. The issue arises from insufficient and inconsistent checks of IPv6 header extension lengths, enabling crafted ICMPv6 or other IPv6-extension-based packets to trigger memory corruption...

CVE-2020-25107

CVE-2020-25107 has concrete details in the connected SUSE advisory: it concerns Nut/Net’s DNS processing (the DNS questions/responses path) in Nut/OS Nut/Net. The vulnerability is an out-of-bounds read (CWE-125) in the DNS handling code, reported for Nut/Net 5.1 and prior, with a CVSSv3 base scor...

CVE-2020-24338

An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in picodnsdecompressname in picodnscommon.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds writ...

Zero-Click Wormable RCE Vulnerability in Cisco Jabber Gets Fixed, Again

Cisco Systems released an updated patch for a critical vulnerability in its video and instant messaging platform Jabber, originally patched in September. The cross-site scripting bug could have allowed an adversary to execute arbitrary code by merely sending a specially-crafted chat message and...