CVE-2023-40743 Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

UNSUPPORTED WHEN ASSIGNED When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose...

CVE-2023-40743

UNSUPPORTED WHEN ASSIGNED When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose...

CVE-2023-40743

Apache Axis 1.x is affected by CVE-2023-40743 due to unsafe handling in ServiceFactory.getService, which can enable DoS, SSRF, and remote code execution when untrusted input is used. The issue arises from LDAP-like lookups via the API. Mitigation is to migrate to a maintained SOAP engine (e.g., A...

Exploit for CVE-2023-4634

CVE-2023-4634 RCE Exploit for Wordpress Plugin Media-Library P...

CVE-2023-39681

Cuppa CMS v1.0 was discovered to contain a remote code execution RCE vulnerability via the emailoutgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload...

Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SS...

CVE-2023-39681

CVE-2023-39681 affects Cuppa CMS v1.0, with a remote code execution (RCE) vulnerability exposed via the email_outgoing parameter in /Configuration.php. The issue is triggered by a crafted payload, enabling an attacker with network access and no privileges to execute code, with high impact to conf...

CVE-2023-4019

The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases...

Code injection

The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases...

CVE-2023-4019

CVE-2023-4019 affects the WordPress plugin Media from FTP, prior to version 11.17. Root cause is improper access control, allowing users with author+ privileges to move sensitive files (e.g., wp-config.php), which may lead to remote code execution in some cases. The issue is fixed in 11.17; upgra...

CVE-2023-4019 Media from FTP < 11.17 - Author+ Arbitrary File Access

The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases...

Exploit for Use of a Broken or Risky Cryptographic Algorithm in Vmware Aria_Operations_For_Networks

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations f...

Exploit for Command Injection in Frangoteam Fuxa

Unauthenticated RCE FUXA CVE-2023-33831 The vulnerability affe...

Exploit for Code Injection in Vmware Spring_Framework

Spring4Shell: CVE-2022-22965 RCE Java Spring framework RCE...

Exploit for Use of a Broken or Risky Cryptographic Algorithm in Vmware Aria_Operations_For_Networks

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations f...

Exploit for Use of a Broken or Risky Cryptographic Algorithm in Vmware Aria_Operations_For_Networks

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations f...

Code injection

Installer RCE on settings file write in MyBB before 1.8.22...

Security Bulletin: IBM Cognos Dashboards on IBM Cloud Pak for Data has addressed security vulnerabilities (CVE-2022-32212, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32222, CVE-2023-26136)

Summary A Remote Code Execution RCE vulnerability in Salesforce tough-cookie CVE-2023-26136 and vulnerabilities reported in the Node.js July 2022 Security Release CVE-2022-32212, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32222 have been resolved in IBM Cognos Dashboards on IBM Clou...

Path Traversal

Zip Swift is vulnerable to Zip Path Traversal vulnerability Zip Slip. The vulnerability is due to not sanitizing zip entry while extracting zip files in a destination directory inside a unzipFile function. An attacker can a create a maliciously crafted zip entry which can be extracted to arbitrar...

CVE-2020-22612

CVE-2020-22612 affects MyBB prior to 1.8.22. The issue is an Installer Remote Code Execution (RCE) vulnerability caused by settings file writes during installation. Impact is high (RCE via installer) as described in multiple sources. The only remediation provided in the connected documents is to ...