CVE-2020-15150

There is a vulnerability in Paginator Elixir/Hex package which makes it susceptible to Remote Code Execution RCE attacks via input parameters to the paginate function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version...

CVE-2020-23829

CVE-2020-23829 affects LibreHealth EHR 2.0.0, specifically interface/new/new_comprehensive_save.php, with an authenticated file-upload flaw that enables remote code execution on the hosting webserver via a crafted image. The descriptions consistently indicate RCE risk when a user uploads a malici...

CVE-2020-15150 Remote Code Execution in paginator(hex)

There is a vulnerability in Paginator Elixir/Hex package which makes it susceptible to Remote Code Execution RCE attacks via input parameters to the paginate function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version...

CVE-2020-15150

CVE-2020-15150 affects the Paginator Elixir/Hex package. The vulnerability allows Remote Code Execution via input parameters to the paginate() function, potentially impacting all users before version 1.0.0. A fix is available in version 1.0.0, which requires Elixir >= 1.5. The connected docume...

GHSA-5G4R-87V2-JQVX Downloads Resources over HTTP in apk-parser

apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

Downloads Resources over HTTP in apk-parser

apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

Mara CMS 7.5 Remote Code Execution

Exploit Title: Mara CMS 7.5 - Remote Code Execution Authenticated Google Dork: N/A Date: 2020-08-31 Exploit Author: Michele Cisternino 0blio Vendor Homepage: https://sourceforge.net/projects/maracms/ Software Link: https://sourceforge.net/projects/maracms/files/MaraCMS75.zip/download Version: 7.5...

WordPress File Manager plugin <= 6.8 - Unauthenticated Arbitrary File Upload leading to RCE vulnerability

Unauthenticated Arbitrary File Upload leading to RCE vulnerability found by w4fz5uck5 in WordPress File Manager plugin versions = 6.8. Solution Update the WordPress File Manager plugin to the latest available version at least 6.9...

Fedora 32 : httpd (2020-189a1e6c3e)

This release includes the latest stable version of Apache httpd, version 2.4.46. A security issue is addressed in this update : - CVE-2020-11984 modproxyuwsgi: Malicious request may result in information disclosure or RCE of existing file on the server running under a malicious process environmen...

File Manager 6.0-6.9 - Unauthenticated Arbitrary File Upload leading to RCE

Seravo noticed multiple cases where WordPress sites were breached using 0-day in wp-file-manager confirmed with v6.8, which was the latest version available in wordpress.org. File lib/php/connector.minimal.php can be by default opened directly, and this file loads...

Exploit for Injection in Oracle Agile_Plm

Oracle-WLS-Weblogic-RCE CVE-2019-2725 Oracle WLSWeblogic R...

Apache2 mod_proxy_uwsgi Incorrect Request Handling Exploit

Apache2 suffers from an incorrect handling of large requests issue in modproxyuwsgi. Apache2: Incorrect handling of large requests in modproxyuwsgi modproxyuwsgi as included in current versions of Apache httpd incorrectly handles large HTTP requests. The UWSGI line protocol uses uint16t length...

Low: httpd24

Issue Overview: No CVE associated with this advisory Affected Packages: httpd24 Issue Correction: Run yum update httpd24 or yum update --advisory ALAS-2020-1418 to update your system. New Packages: i686: mod24proxyhtml-2.4.46-1.90.amzn1.i686 httpd24-tools-2.4.46-1.90.amzn1.i686 ...

CVE-2020-15159

CVE-2020-15159 affects baserCMS 4.3.6 and earlier. The vulnerability involves Cross Site Scripting (XSS) and Remote Code Execution (RCE) through arbitrary script uploads, exploitable by logging in as an administrator. Affected components are ThemeFilesController.php and UploaderFilesController.ph...

EulerOS 2.0 SP8 : httpd (EulerOS-SA-2020-1854)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging...

WordPress Autoptimize 2.7.6 Shell Upload

Exploit Title: Wordpress Plugin Autoptimize 2.7.6 - Arbitrary File Upload Authenticated Date: 2020-08-24 Software Link: https://wordpress.org/plugins/autoptimize/ Author : SunCSR Team Version: v2.7.6 Tested on Ubuntu 18.04 / Kali Linux Reference: https://wpvulndb.com/vulnerabilities/10372...

Foxit Studio Photo < 3.6.6.928 Out-of-Bounds Write

According to its self-reported version, the Foxit Studio Photo application installed on the remote Windows host is prior to 3.6.6.928. It is, therefore, affected by an out-of-bounds write error when processing PSD files. A remote, unauthenticated attacker could trick a victim into opening a...

Node.js third-party modules: [i18next] Prototype pollution attack

I would like to report a prototype pollution vulnerability in i18next. It allows to modify the prototype of a base object, which may result in DoS, XSS, RCE, etc. depending on the way the library is used. Module module name: i18next version: 19.7.0 npm page: https://www.npmjs.com/package/i18next...

Mida eFramework 2.9.0 Remote Code Execution

Exploit Title: Mida eFramework 2.9.0 - Remote Code Execution Google Dork: Server: Mida eFramework Date: 2020-08-27 Exploit Author: elbae Vendor Homepage: https://www.midasolutions.com/ Software Link: http://ova-efw.midasolutions.com/ Reference:...

IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.17 / 9.0.x < 9.0.5.4 RCE (6258333)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.0.0 through to 8.5.5.17, or 9.0.0.0 through 9.0.5.4. It is, therefore, affected by an remote code execution vulnerability. An authenticated, remote attacker can explo...