CVE-2022-22965 and CVE-2022-22963 vulnerabilities

Two distinct spring project vulnerabilities where released recently with critical CVSS score and classified as zero-Day attacks. The two vulnerabilities are currently known as : CVE-2022-22965 or Spring4Shell: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remot...

WSO2 Arbitrary File Upload to RCE

This module abuses a vulnerability in certain WSO2 products that allow unrestricted file upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5....

CVE-2022-24796

RaspberryMatic WebUI file upload vulnerability allows remote, unauthenticated RCE via shell metacharacters in HTTP query strings. The root cause is missing input validation/sanitization in the upload mechanism. Affected versions are 2.31.25.20180428 through 3.63.7.20220226 (note: exact upper boun...

Exploit for Code Injection in Vmware Spring_Cloud_Function

Spring CVE This includes CVE-2022-22963, a Spring SpEL / Expre...

Remote code execution

A Remote Code Execution RCE vulnerability exists in The-Secretary 2.5 via install.php...

CVE-2021-43484

A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...

Remote code execution

A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...

CVE-2021-43479

CVE-2021-43479 affects The-Secretary 2.5 and is a Remote Code Execution (RCE) via install.php. The vulnerability is documented with high/severe CVSS metrics (CVSSv3.1: 9.8, NETWORK, LOW attack complexity, NONE privileges required, NONE user interaction, high impact on confidentiality, integrity a...

CVE-2021-43484

CVE-2021-43484 affects Simple Client Management System 1.0, specifically the create.php file, where remote code execution arises from failure to validate the extension of a file in a request. The vulnerability is documented with a high/severe impact (CVSS v3.1: 9.8, CRITICAL, network access, no u...

CVE-2021-34257

Multiple Remote Code Execution RCE vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to 1 Dashboard's Avatar image, 2 Posts Folder image, 3 Pages Folder image and 4 Gallery Folder image...

Remote code execution

Multiple Remote Code Execution RCE vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to 1 Dashboard's Avatar image, 2 Posts Folder image, 3 Pages Folder image and 4 Gallery Folder image...

Exploit for Code Injection in Vmware Spring_Framework

CVE-2022-22965 aka "Spring4Shell" Vulnerabilidad RCE en Spri...

CVE-2021-34257

WPanel 4.x (

Exploit for Code Injection in Vmware Spring_Framework

Spring Framework RCE exploitation Quick pentest notes...

Imperva Protects from New Spring Framework Zero-Day Vulnerabilities

New zero-day Remote Code Execution RCE vulnerabilities were discovered in Spring Framework, an application development framework and inversion of control container for the Java platform. The vulnerability potentially leaves millions of applications at risk of compromise. In two separate...

Exploit for Code Injection in Vmware Spring_Framework

spring-core-rce Spring Core RCE – Simple exploitation Can...

Exploit for Code Injection in Vmware Spring_Framework

Spring Core RCE/CVE-2022-22965 Impacted versions: Spring fr...

Remote Code Execution (RCE)

netatalk is vulnerable to remote code execution. The vulnerability exists due to a lack of validation of the length of user-supplied data prior to copying it to a heap-based buffer...

Exploit for Code Injection in Vmware Spring_Cloud_Function

CVE-2022-22963 CVE-2022-22963 PoC Slight modified for Englis...

Chrome Zero-Day from North Korea

North Korean hackers have been exploiting a zero-day in Chrome. The flaw, tracked as CVE-2022-0609, was exploited by two separate North Korean hacking groups. Both groups deployed the same exploit kit on websites that either belonged to legitimate organizations and were hacked or were set up for...