CVE-2020-9496

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03...

Rocket.Chat: Insecure use of shell.openExternal() in Rocket.Chat Desktop App leading to RCE

Summary: The Rocket.Chat Desktop app passes the links users click on to Electron's shell.openExternal function which can lead to remote code execution. Description: The filtering on the URLs passed to shell.openExternal is insufficient. An attacker can craft and send a link that when clicked will...

Oracle WebLogic IIOP JNDI Lookup RCE Direct Check

Binary data oracleweblogiciiopcve-2020-2551.nbin...

CVE-2020-1444

CVE-2020-1444 is described across multiple connected sources as a remote code execution vulnerability in Microsoft SharePoint, triggered by parsing specially crafted email messages. The Red Hat and CNVD entries reiterate the same root cause, and Nessus-based scans list CVE-2020-1444 among several...

CVE-2020-1403

Technical details about CVE-2020-1403 are not provided in the connected documents; no specific products, root cause, impact, or remediation are listed here. Monitor for updates.

July 2020 Patch Tuesday – 123 Vulnerabilities, 18 Critical, Hyper-V RemoteFX, DNS Server, Workstation, Adobe

This month’s Microsoft Patch Tuesday addresses 123 vulnerabilities with 18 of them labeled as Critical. The 18 Critical vulnerabilities cover Hyper-V, DNS Server, PerformancePoint, SharePoint Server, Office, Outlook, Remote Desktop, and several other workstation vulnerabilities. Adobe issued...

17-Year-Old Critical 'Wormable' RCE Vulnerability Impacts Windows DNS Servers

Cybersecurity researchers today disclosed a new highly critical "wormable" vulnerability—carrying a severity score of 10 out of 10 on the CVSS scale—affecting Windows Server versions 2003 to 2019. The 17-year-old remote code execution flaw CVE-2020-1350, dubbed 'SigRed' by Check Point, could allo...

July 2020 Security Update: CVE-2020-1350 Vulnerability in Windows Domain Name System (DNS) Server

Today we released an update for CVE-2020-1350, a Critical Remote Code Execution RCE vulnerability in Windows DNS Server that is classified as a ‘wormable’ vulnerability and has a CVSS base score of 10.0. This issue results from a flaw in Microsoft’s DNS server role implementation and affects all...

Nintendo: [3DS][StreetPass] Heap Overflow in Swapnote parser leads to userland StreetPass RCE

Affected Systems - System: Nintendo 3DS - Version: = 11.13 - Region: ALL Description When parsing TLRF chunks in message files the application calls memcpy using user provided sizes to copy controlled data over a fixed-size buffer. Thus one can overflow heap chunks which is enough to get code...

Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system,...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

Apache Dubbo Deserialization Vulnerability Research This repo...

Microsoft Addresses 'Wormable' RCE Vulnerability in Windows DNS Server

Microsoft has released a security update to address a remote code execution RCE vulnerability—CVE-2020-1350—in Windows DNS Server. A remote attacker could exploit this vulnerability to take control of an affected system. This is considered a “wormable” vulnerability that affects all Windows Serve...

Online Birth Certificate System 1.0 SQL Injection / Code Execution

Exploit Title: Online Birth Certificate System - RCE Through SQLi Date: 2020-07-08 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/online-birth-certificate-system-using-php-and-mysql/ Software Link:...

Online DJ Booking Management System Project Report 1.0 SQL Injection / Code Execution

Exploit Title: Online DJ Booking Management System Project Report - RCE Through SQLi Authenticated User - admin Date: 2020-07-12 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

F5 BIG-IP RCE CVE-2020-5902 Vulnerability Detection Tool ==...

FreeBSD : mybb -- multible vulnerabilities (198a120d-c22d-11ea-9172-4c72b94353b5)

mybb Team reports : High risk: Installer RCE on settings file write Medium risk: Arbitrary upload paths and Local File Inclusion RCE Medium risk: XSS via insufficient HTML sanitization of Blog feed and Extend data Low risk: Open redirect on login Low risk: SCEditor reflected XSS C Tenable Network...

Cisco NX-OS Software Internet Group Management Protocol Snooping RCE and DoS (cisco-sa-20180620-nxosigmp)

According to its self-reported version, Cisco NX-OS Software is affected by a due to a buffer overflow condition in the IGMP Snooping subsystem. An attacker could exploit this vulnerability by sending crafted IGMP packets to an affected system. An exploit could allow the attacker to execute...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

CVE-2020-5902 Summary In BIG-IP versions 15.0.0-15.1.0.3,...

CVE-2020-12736

Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local non-SSO user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator enter...

GHSA-CR3X-7M39-C6JQ Remote code execution via user-provided local names in ActionView

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render call to perform a RCE...