13318 matches found
Attackers Can Exploit Critical Cisco Jabber Flaw With One Message
Researchers are warning of a critical remote code-execution RCE flaw in the Windows version of Cisco Jabber, the networking company’s video-conferencing and instant-messaging application. Attackers can exploit the flaw merely by sending targets specially crafted messages – no user interaction...
CVE-2020-24949
CVE-2020-24949 affects PHP-Fusion 9.03.50 in downloads/downloads.php, where an authenticated non-admin user can send a crafted request to trigger remote code execution. The underlying issue enables arbitrary code execution on the server, with the vulnerability classified as high severity (CVSS v3...
@argdown/image-export (>=1.5.0, <=1.7.5), @automattic/wordpress-external-dependencies-plugin (1.0.0-alpha.0) +243 more potentially affected by CVE-2019-5786 via puppeteer (>=1.0.0, <=1.12.2)
puppeteer NPM version =1.0.0, =1.5.0, =0.190.0, =0.0.36, =0.0.1, =0.0.18, =0.0.1, =1.0.3, =1.3.4, =0.1.0, =0.0.10, =4.0.0-alpha.3, =8.0.1 and more Source cves: CVE-2019-5786 Source advisory: OSV:GHSA-C2GP-86P4-5935...
CVE-2020-15094 RCE in Symfony
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially...
CVE-2020-5776
Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...
Cross site request forgery (csrf)
Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...
CVE-2020-5776
Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...
CVE-2020-5776
CVE-2020-5776 affects MAGMI (Magento Mass Importer). MAGMI is vulnerable to cross-site request forgery (CSRF) due to lack of CSRF tokens, and CSRF could be leveraged to achieve remote code execution (RCE) via the phpcli command when an admin session is present. Affected versions include all MAGMI...
CVE-2020-15150
There is a vulnerability in Paginator Elixir/Hex package which makes it susceptible to Remote Code Execution RCE attacks via input parameters to the paginate function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version...
CVE-2020-15150
There is a vulnerability in Paginator Elixir/Hex package which makes it susceptible to Remote Code Execution RCE attacks via input parameters to the paginate function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version...
CVE-2020-23829
CVE-2020-23829 affects LibreHealth EHR 2.0.0, specifically interface/new/new_comprehensive_save.php, with an authenticated file-upload flaw that enables remote code execution on the hosting webserver via a crafted image. The descriptions consistently indicate RCE risk when a user uploads a malici...
CVE-2020-15150 Remote Code Execution in paginator(hex)
There is a vulnerability in Paginator Elixir/Hex package which makes it susceptible to Remote Code Execution RCE attacks via input parameters to the paginate function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version...
CVE-2020-15150
CVE-2020-15150 affects the Paginator Elixir/Hex package. The vulnerability allows Remote Code Execution via input parameters to the paginate() function, potentially impacting all users before version 1.0.0. A fix is available in version 1.0.0, which requires Elixir >= 1.5. The connected docume...
Downloads Resources over HTTP in apk-parser
apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...
GHSA-5G4R-87V2-JQVX Downloads Resources over HTTP in apk-parser
apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...
Mara CMS 7.5 Remote Code Execution
Exploit Title: Mara CMS 7.5 - Remote Code Execution Authenticated Google Dork: N/A Date: 2020-08-31 Exploit Author: Michele Cisternino 0blio Vendor Homepage: https://sourceforge.net/projects/maracms/ Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download Version: 7.5...
WordPress File Manager plugin <= 6.8 - Unauthenticated Arbitrary File Upload leading to RCE vulnerability
Unauthenticated Arbitrary File Upload leading to RCE vulnerability found by w4fz5uck5 in WordPress File Manager plugin versions = 6.8. Solution Update the WordPress File Manager plugin to the latest available version at least 6.9...
Fedora 32 : httpd (2020-189a1e6c3e)
This release includes the latest stable version of Apache httpd, version 2.4.46. A security issue is addressed in this update : - CVE-2020-11984 modproxyuwsgi: Malicious request may result in information disclosure or RCE of existing file on the server running under a malicious process environmen...
File Manager 6.0-6.9 - Unauthenticated Arbitrary File Upload leading to RCE
Seravo noticed multiple cases where WordPress sites were breached using 0-day in wp-file-manager confirmed with v6.8, which was the latest version available in wordpress.org. File lib/php/connector.minimal.php can be by default opened directly, and this file loads...
