Exploit for Improper Certificate Validation in Backblaze

CVE-2020-8289 – Remote Code Execution as SYSTEM/root via Backb...

Microsoft Excel 2016 RCE and Information Disclosure Vulnerabilities (KB4484507)

This host is missing an important security update according to Microsoft KB4484507 Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft Excel 2013 RCE and Information Disclosure Vulnerabilities (KB4484526)

This host is missing an important security update according to Microsoft KB4484526 Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x <= 8.5.5.17 / 9.0.x <= 9.0.5.4 RCE (6255074)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.0.0 through to 8.5.5.17, or 9.0.0.0 through 9.0.5.4. It is, therefore, affected by an remote code execution vulnerability. An authenticated, local attacker can exploi...

Microsoft Excel 2010 RCE and Information Disclosure Vulnerabilities (KB4486665)

This host is missing an important security update according to Microsoft KB4486665 Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Microsoft's Patch Tuesday Packed with Critical RCE Bugs

Microsoft has released patches for 129 security bugs in its September Patch Tuesday update. These include 23 critical flaws, 105 that are important in severity and one moderate bug. Fortunately, none are publicly known or under active exploitation, Microsoft said. The most severe issue in the bun...

KLA11955 RCE vulnerability in Microsoft Exchange Server

Remote code execution vulnerability was found in Microsoft Exchange Server. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2020-16875 Exploitation Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details...

WordPress Autoptimize Plugin <= 2.7.6 RCE Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113753";...

Remote Code Execution (RCE)

PostgreSQL is vulnerable to remote code execution RCE. It did not use searchpath safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the installation or update of such extension...

Symfony 4.3.0 - 4.4.12, 5.0.0 - 5.1.4 RCE Vulnerability

Symfony is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sensiolabs:symfony...

Cisco Small Business RV340 Series Routers Firmware < 1.0.03.19 Command Injection and RCE (cisco-sa-rv-osinj-rce-pwTkPCJv)

According to its self-reported version, Cisco Small Business RV Series Router Firmware is prior to 1.0.03.19. It is, therefore, affected by multiple vulnerabilities in the web-based management interface that can allow an authenicated, remote attacker with administrative credentials to execute...

ManageEngine Applications Manager Authenticated Remote Code Execution

!/usr/bin/python3 Exploit Title: ManageEngine Applications Manager - Authenticated RCE via Java class reflection in Weblogic server test credential API Google Dork: None Date: 04-09-2020 Exploit Author: Hodorsec Vendor Homepage: https://manageengine.co.uk Vendor Vulnerability Description:...

CVE-2020-3495

Cisco Jabber is vulnerable to Cross Site Scripting XSS through XHTML-IM messages. The application does not properly sanitize incoming HTML messages and instead passes them through a flawed XSS filter. Recent assessments: wvu-r7 at September 03, 2020 7:38pm UTC reported: This XSS combined with...

Fedora 31 : httpd (2020-0d3d3f5072)

This release includes the latest stable version of Apache httpd, version 2.4.46. A security issue is addressed in this update : - CVE-2020-11984 modproxyuwsgi: Malicious request may result in information disclosure or RCE of existing file on the server running under a malicious process environmen...

Attackers Can Exploit Critical Cisco Jabber Flaw With One Message

Researchers are warning of a critical remote code-execution RCE flaw in the Windows version of Cisco Jabber, the networking company’s video-conferencing and instant-messaging application. Attackers can exploit the flaw merely by sending targets specially crafted messages – no user interaction...

CVE-2020-24949

CVE-2020-24949 affects PHP-Fusion 9.03.50 in downloads/downloads.php, where an authenticated non-admin user can send a crafted request to trigger remote code execution. The underlying issue enables arbitrary code execution on the server, with the vulnerability classified as high severity (CVSS v3...

@argdown/image-export (>=1.5.0, <=1.7.5), @automattic/wordpress-external-dependencies-plugin (1.0.0-alpha.0) +243 more potentially affected by CVE-2019-5786 via puppeteer (>=1.0.0, <=1.12.2)

puppeteer NPM version =1.0.0, =1.5.0, =0.190.0, =0.0.36, =0.0.1, =0.0.18, =0.0.1, =1.0.3, =1.3.4, =0.1.0, =0.0.10, =4.0.0-alpha.3, =8.0.1 and more Source cves: CVE-2019-5786 Source advisory: OSV:GHSA-C2GP-86P4-5935...

CVE-2020-15094 RCE in Symfony

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially...

CVE-2020-5776

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...

Cross site request forgery (csrf)

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE via phpcli command is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI...