13197 matches found
Remote Code Execution (RCE)
exim is vulnerable to Remote Code Execution RCE. The vulnerability arises from the absence of proper validation for user-supplied data in the SMTP service. This could result in a buffer overflow, enabling an attacker to inject and execute malicious code within the service account's context...
CVE-2023-43835
Summary: CVE-2023-43835 affects Super Store Finder 3.7 and earlier. The issue is an authenticated Arbitrary PHP Code Injection vulnerability that can lead to remote code execution when settings overwrite the content of config.inc.php. What’s affected: Super Store Finder software, versions ≤ 3.7. ...
Juniper SRX Firewall / EX Switch Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'unixcrypt' require 'net/ssh' require 'net/ssh/commandstream' class MetasploitModule 'Junos OS PHPRC Environment Variable Manipulation RCE', 'Description' = %q...
CVE-2023-5201
OpenHook (WordPress plugin) is vulnerable to Remote Code Execution up to and including version 4.3.0 via the php shortcode. Exploitation requires the php shortcode setting to be enabled and an attacker with subscriber privileges or higher. The vulnerability is documented as CVE-2023-5201. Patch s...
CVE-2023-5201 OpenHook <= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode
The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. This requires the php shortcode setting to be...
CVE-2023-43655
Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22 an...
CVE-2023-43655
CVE-2023-43655 affects the PHP dependency manager Composer when a user publishes a web-accessible composer.phar that can be executed as PHP and PHP is configured with register_argc_argv enabled . Multiple connected advisories confirm the vulnerability exists in Composer and describe that versions...
Exploit for Unrestricted Upload of File with Dangerous Type in Amentotech Workreap
CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthentic...
Exim <= 4.96.2 libspf2 RCE Vulnerability (Sep 2023)
Exim is prone to a remote code execution RCE vulnerability in the used libspf2 library. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Exploit for Race Condition in Microsoft
CVE-2023-36884: MS Office HTML RCE with crafted documents On...
CVE-2023-38874
CVE-2023-38874 affects Economizzer v0.9-beta1. The vulnerability is an insecure file upload that lets an attacker upload a PHP web shell as an attachment when adding a new cash book entry, then access the shell to execute arbitrary commands. This results in remote code execution (RCE) with high i...
CVE-2023-42116
Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling o...
JetBrains Patches Severe TeamCity Flaw Allowing RCE and Server Hijacking
By Deeba Ahmed JetBrains has fixed this flaw in version 2023.05.4 of the product released on September 18. It also released a security advisory but didn't disclose technical details of the vulnerability for now. This is a post from HackRead.com Read the original post: JetBrains Patches Severe...
Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-005)
The version of tomcat installed on the remote host is prior to 8.5.79-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-005 advisory. A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux,...
JetBrains TeamCity < 2023.05.4 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2023.05.4. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible CVE-2023-42793 - In JetBrains TeamCity before...
CVE-2023-5183 Authenticated RCE due to unsafe JSON deserialization
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the networktraffic API endpoint. An attacker can leverage this vulnerability to execute...
CVE-2023-5183 Authenticated RCE due to unsafe JSON deserialization
Unsafe deserialization of untrusted JSON allows execution of arbitrary code on affected releases of the Illumio PCE. Authentication to the API is required to exploit this vulnerability. The flaw exists within the networktraffic API endpoint. An attacker can leverage this vulnerability to execute...
Exploit for PHP External Variable Modification in Juniper Junos
CVE-2023-36845 Description CVE-2023-36845 represen...