Updated xterm packages fix security vulnerability

xterm before patch 375 can enable an RCE under certain conditions...

Microsoft Patch Tuesday November 2022: Exchange ProxyNotShell RCE, JScript9, MoTW, OpenSSL, Edge, CNG, Print Spooler

Hello everyone! This episode will be about Microsoft Patch Tuesday for November 2022, including vulnerabilities that were added between October and November Patch Tuesdays. As usual, I use my open source Vulristics project to create the report. Alternative video link for Russia: The most importan...

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

CVE-2022-39197 RCE POC Reference Links https://mp...

CVE-2022-4136

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method...

Security feature bypass

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method...

CVE-2022-4136

CVE-2022-4136 affects qmpass/leadshop v1.4.15. The vulnerability arises from leadshop.php using call_user_func_array with GET-supplied include, data, and meta, enabling an attacker to invoke arbitrary functions (e.g., HttpGet, ToMkdir, UpdateSql, DownloadFile, RemoveDir) and potentially execute c...

CVE-2022-4136 Exposed Dangerous Method or Function in qmpaas/leadshop

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method...

Remote code execution

dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution RCE via filemanagecontrol.php...

Remote code execution

A remote code execution RCE vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE remote code execution on the attacked system running Optica. The vulnerability was patched in v...

CVE-2022-41922

yiisoft/yii before version 1.1.27 are vulnerable to Remote Code Execution RCE if the application calls unserialize on arbitrary user input. This has been patched in 1.1.27...

CVE-2020-23584

Summary: CVE-2020-23584 affects the OPTILINK OP-XT71000N (Hardware Version V2.2). An unauthenticated attacker can trigger remote code execution by sending crafted input in the PingTest parameter, exploiting a command-injection flaw via the IP-ADDRESS field using the pipe character (" | ") to targ...

CVE-2022-41875

Optica prior to version 0.10.2 is affected by a remote code execution (RCE) vulnerability triggered by specially crafted JSON payloads. The underlying issue involves unsafe deserialization via the Ruby JSON library oj.load; the fix moves to oj.safe_load in version 0.10.2, mitigating the RCE risk....

CVE-2022-41922

The CVE-2022-41922 entry affects the PHP framework yiisoft/yii. Prior to version 1.1.27, applications that call unserialize() on arbitrary user input are vulnerable to Remote Code Execution. The issue has been patched in 1.1.27. The vulnerability carries a high/critical impact potential per multi...

ZoneMinder < 1.36.13 Multiple Vulnerabilities

ZoneMinder is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zoneminder:zoneminder"; if...

CVE-2022-44118

dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution RCE via filemanagecontrol.php...

Sophos XG Firewall <= 19.0.1 RCE

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable, Inc...

CVE-2022-41875 Remote Code Execution in Optica

A remote code execution RCE vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially crafted JSON payloads may lead to RCE remote code execution on the attacked system running Optica. The vulnerability was patched in v...

CVE-2022-44118

CVE-2022-44118 affects dedecmdv6 v6.1.9, with a Remote Code Execution (RCE) vulnerability via the file_manage_control.php endpoint. Public sources consistently identify an RCE risk in this version; details include the affected software (dedecmdv6 v6.1.9) and the vulnerable endpoint. The issue is ...

Microsoft Office 365 (2016 Click-to-Run) Multiple RCE Vulnerabilities (Apr 2022)

This host is missing a critical security update according to Microsoft Office Click-to-Run updates SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Rocket.Chat: Insecure use of shell.openExternal() leads to RCE in Rocket.Chat-Desktop

Rocket.Chat-Desktop passes the parameter url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used...