Exploit for Code Injection in Moodle

CVE-2021-36394-Pre-Auth-RCE-in-Moodle Vulnerability Introd...

Iranian Hackers Exploiting VMware RCE Bug to Deploy 'Core Impact' Backdoor

An Iranian-linked threat actor known as Rocket Kitten has been observed actively exploiting a recently patched VMware vulnerability to gain initial access and deploy the Core Impact penetration testing tool on vulnerable systems. Tracked as CVE-2022-22954 CVSS score: 9.8, the critical issue...

CVE-2022-29806

ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability...

CVE-2022-29806

CVE-2022-29806 affects ZoneMinder prior to 1.36.13 (and 1.37.11). A path-traversal flaw combined with an arbitrary log file write in the language/debug log path allows attackers to write and execute arbitrary code, enabling remote command execution. There is public exploitation evidence (GitHub e...

Apache APISIX < 2.10.4 / 2.11.x < 2.12.1 RCE

The version of Apache APISIX installed on the remote host is prior to 2.10.4 or 2.11.x prior to 2.12.1. It is, therefore, affected by a remote code execution vulnerability due to flaw in the product's source code. An unauthenticated, remote attacker can exploit this to bypass authentication and...

Researchers Takeover Unpatched 3rd-Party Antivirus Sandboxes via VirusTotal

Security researchers have disclosed a security issue that could have allowed attackers to weaponize the VirusTotal platform as a conduit to achieve remote code execution RCE on unpatched third-party sandboxing machines employed antivirus engines. The flaw, now patched, made it possible to "execut...

CVE-2022-1390

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a...

Deserialization of untrusted data

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a...

CVE-2022-1390 Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a...

CVE-2021-25094 Tatsu < 3.3.12 - Unauthenticated RCE

The Tatsu WordPress plugin before 3.3.12 addcustomfont action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control...

CVE-2021-45837

It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 by sending a specifically crafted input to /tos/index.php?app/del...

Internet Bug Bounty: CVE-2022-28738: Double free in Regexp compilation

Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from...

Oracle Tuxedo RCE (Apr 2022 CPU)

The version of Tuxedo installed on the remote host is missing a security patch. It is, therefore affected by a remote code execution vulnerability in the bundled Apache Log4J component. Successful exploitation of this vulnerability allow an unauthenticated attacker with network access via HTTP...

VMware Workspace One Access / VMware Identity Manager Server-side Template Injection RCE (CVE-2022-22954)

Binary data vmwareworkspaceoneaccesscve-2022-22954.nbin...

Metasploit Weekly Wrap-Up

ManageEngine ADSelfService Plus Authenticated RCE This module is pretty exciting for us because it's for a vulnerability discovered by our very own Rapid7 researchers Jake Baines, Hernan Diaz, Andrew Iwamaye, and Dan Kelly. The vulnerability allowed for attackers to leverage the "custom script"...

Aiven Ltd: [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal Jolokia

Summary: The Aiven JDBC sink includes the SQLite JDBC Driver. This JDBC driver can be used to upload SQLite database files onto the server. The HTTP sink connector allows sending HTTP requests to localhost. There is unprotected Jolokia listening on localhost:6725. JMX exports the...

VMware Cloud Director 10.1.x < 10.1.4.1 / 10.2.x < 10.2.2.3 / 10.3.x < 10.3.3 RCE (VMSA-2022-0013)

The version of VMware vCloud Director installed on the remote host is 10.1.x prior to 10.1.4.1, 10.2.x prior to 10.2.2.3, 10.3.x 10.3.3. It is, therefore, affected by a code injection vulnerability due to a failure to properly handle input. A remote, authenticated actor can exploit this, by sendi...

CVE-2022-28021

Purchase Order Management System v1.0 was discovered to contain a remote code execution RCE vulnerability via /purchaseorder/admin/?page=user...

Remote code execution

Purchase Order Management System v1.0 was discovered to contain a remote code execution RCE vulnerability via /purchaseorder/admin/?page=user...

CVE-2022-27478

Victor CMS v1.0 contains a remote code execution (RCE) vulnerability exploitable through the component admin/profile.php?section=admin. The set of connected documents consistently describes an RCE without detailing the root cause or exact exploit path beyond the vulnerable endpoint. Impact is des...