SpamTitan 7.07 Remote Code Execution

Exploit Title: SpamTitan 7.07 - Remote Code Execution Authenticated Date: 2020-09-18 Exploit Author: Felipe Molina @felmoltor Vendor Homepage: https://www.titanhq.com/spamtitan/spamtitangateway/ Software Link: https://www.titanhq.com/signup/?producttype=spamtitangateway Version: 7.07 Tested on:...

Cross site request forgery (csrf)

The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery CSRF and Remote Code Execution RCE. The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially...

CVE-2020-15183

CVE-2020-15183 affects SoyCMS 3.0.2 and earlier. The root cause is a Reflected XSS leading to Remote Code Execution due to insecure elFinder configuration that enables Unrestricted File Upload. This can allow an attacker to coerce the administrator into executing actions on a crafted page, potent...

CVE-2020-15183 Reflected XSS leading to RCE in SoyCMS

SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting XSS which leads to Remote Code Execution RCE from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage...

CVE-2020-15182 Cross-site Request Forgery leading to RCE in SOY CMS

The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery CSRF and Remote Code Execution RCE. The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially...

Important: httpd

Issue Overview: Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE A flaw was found in Apache httpd in versions 2.4.32 to 2.4.46. The uwsgi protocol does not serialize more than 16K of HTTP header leading to resource exhaustion and denial of service. The highest...

in seleniumhq/selenium

Description Selenium is an umbrella project encapsulating a variety of tools and libraries enabling web browser automation. Selenium specifically provides infrastructure for the W3C WebDriver specification — a platform and language-neutral coding interface compatible with all major web browsers...

QIWI: MobileIron Unauthenticated RCE on mdm.qiwi.com with WAF bypass

Last week, details about 3 CVEs affecting MobileIron MDM product were disclosed. When combined, an attacker can achieve unauthenticated remote code execution with arbitrary Java deserialization vector : - CVE-2020-15505 - Remote Code Execution - CVE-2020-15506 - Authentication Bypass -...

Acronis Cyber Backup 12.5 Build 16341 Server-Side Request Forgery

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Acronis Cyber Backup Vendor URL: https://www.acronis.com Type: Server-Side Request Forgery CWE-918 Date found: 2020-07-30 Date published: 2020-09-14 CVSSv3 Score: 8.3...

IBM Spectrum Protect Plus Security Open to RCE

IBM has issued fixes for vulnerabilities in Spectrum Protect Plus, Big Blue’s security tool found under the umbrella of its Spectrum data storage software branding. The flaws can be exploited by remote attackers to execute code on vulnerable systems. IBM Spectrum Protect Plus is a data-protection...

Researcher hacked Facebook by exploiting flaws in MobileIron MDM

By Sudais Asif The researcher hacked Facebook after identifying and exploiting Unauthenticated RCE on MobileIron's Mobile Device Management MDM. This is a post from HackRead.com Read the original post: Researcher hacked Facebook by exploiting flaws in MobileIron MDM...

Prototype Pollution in liriliri/licia

Description licia package is vulnerable to prototype pollution issue files can be found in https://github.com/liriliri/licia/blob/master/src/e/extendDeep.js & https://github.com/liriliri/licia/blob/master/src/s/safeSet.jsL46 Proof of Concept 1. Creating poc filed js var utils = require'licia'; va...

Microsoft Windows Codecs Library AV1 RCE (August 2020)

The Windows 'AV1 Video Extension' or 'AV1 from Device Manufacturer' app installed on the remote host is affected by two code execution vulnerabilities. An unauthenticated, remote attacker can exploit either of these vulnerabilities via a image file to execute code and gain control of the system. ...

Remote Code Execution (RCE)

chakracore is vulnerable to remote code execution. The vulnerability exists due to a memory corruption issue when updating the InlineeFrameDisplay...

Prototype Pollution in pierreinglebert/json-merge-patch

Description json-merge-patch is vulnerable to Prototype Pollution. This package fails to restrict access to prototypes of objects, allowing for modification of prototype behavior using a proto payload, which may result in Information Disclosure/DoS/RCE. Proof of Concept 1. Create the following Po...

Apache Struts 2 Forced Multi OGNL Evaluation

The Apache Struts framework, when forced, performs double evaluation of attributes' values assigned to certain tags attributes such as id. It is therefore possible to pass in a value to Struts that will be evaluated again when a tag's attributes are rendered. With a carefully crafted request, thi...

Node.js third-party modules: [json8-merge-patch] Prototype Pollution

I would like to report a Prototype Pollution vulnerability in json8-merge-patch The apply function fails to restrict access to prototypes of objects, allowing for modification of prototype behavior. Module module name: json8-merge-patch version: v1.0.1 npm page:...

Node.js third-party modules: [ts-dot-prop] Prototype Pollution

I would like to report a Prototype Pollution vulnerability in ts-dot-prop. It allows an attacker to inject properties on Object.prototype. Module module name: ts-dot-prop version: 1.4.0 npm page: https://www.npmjs.com/package/ts-dot-prop Module Description TypeScript utility to transform nested...

CVE-2020-1218 Microsoft Word Remote Code Execution Vulnerability

...

VTENEXT 19 CE - Remote Code Execution

!/usr/bin/python3 Exploit Title: VTENEXT 19 CE - Remote Code Execution Google Dork: n/a Date: 2020/09/09 Exploit Author: Marco Ruela Vendor Homepage: https://www.vtenext.com/en/ Software Link: Vendor removed vulnerable version from sourceforge.net Version: 19 CE Tested on: Ubuntu 16.04 CVE : N/A...