Zerodium Spikes Payout for Outlook Zero-Days

Zerodium has jacked up its offering price for Microsoft Outlook zero-day exploits. Act fast if you have the goods and the moral equanimity, to make up to $400,000 for a zero-click, remote code-execution RCE exploit. “Zero-click” means that targets neither have to read a malicious email message no...

Metasploit Weekly Wrap-Up

I'm sure you know what's coming, more Log4Shell For those wondering when the Log4Shell remediation nightmare will end, I'm afraid I can't give you that. What I can give you, though, is a new Log4Shell module! With the new module from zeroSteiner you can expect to get unauthenticated RCE on the...

CVE-2021-45897

SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution...

CVE-2021-45897

Summary (CVE-2021-45897) : SuiteCRM versions prior to 7.12.3 and 8.x prior to 8.0.2 are affected by a remote code execution (RCE) vulnerability. The issue stems from the EmailTemplates / Notes attachment handling, where an authenticated user can upload a PHP webshell via an attachment and trigger...

Mageia: Security Advisory (MGASA-2018-0001)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-44971: Incorrect Comparison

Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20multi?AC5V1.0 Firmware V15.03.06.48multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE...

Mageia: Security Advisory (MGASA-2018-0002)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2022-0002)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unspecified vulnerability in jpress (CNVD-2022-08351)

Jpress is Jpress team of a set of blogging platform developed using the Java language . A security vulnerability exists in jpress that stems from vulnerability to RCE attacks via io.jpress.web.admin. Attackers can exploit this vulnerability by uploading templates and injecting malicious code...

CVE-2021-46428

CVE-2021-46428 affects Sourcecodester Simple Chatbot Application 1.0 (and earlier versions). The vulnerability is an RCE exposed via the bot_avatar parameter in SystemSettings.php, enabling remote code execution. The available sources indicate a high-severity impact with network access and no aut...

CVE-2021-46097

DolphinPHP v1.5.0 is affected by a remote code execution vulnerability in /application/common.php#action_log. The root cause is input handling in the common.php component (manipulation of the argument id) that permits arbitrary commands to be executed, with remote, unauthenticated access potentia...

CVE-2021-46088

CVE-2021-46088 affects Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS. The vulnerability allows Remote Code Execution because of insufficient filtering/escaping of user-submitted command parameters, enabling any user with the Zabbix Admin role to run a shell script on the application server in the applica...

CVE-2021-46428: Unrestricted Upload of File with Dangerous Type

A Remote Code Execution RCE vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 and previous versions via the botavatar parameter in SystemSettings.php...

Apple Fixes 2 Zero-Day Security Bugs, One Exploited in the Wild

Apple on Wednesday released 13 patches for serious security bugs in macOS and 10 for flaws in iOS/iPadOS. They include fixes for two zero-day bugs, one of which may have been exploited by attackers in the wild. The first zero-day CVE-2022-22587 is a memory-corruption issue that could be exploited...

CVE-2021-46114

jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

CVE-2021-46114

CVE-2021-46114 affects jpress v4.2.0. The vulnerability is a remote code execution through io.jpress.module.product.ProductNotifyKit#doSendEmail , where the admin panel’s email template editor can be abused to inject malicious code. Impact: arbitrary code execution; reported in multiple sources. ...

CVE-2021-46114

jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

CVE-2021-46115

jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin.TemplateControllerdoUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code...

Code injection

jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin.TemplateControllerdoUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code...

CVE-2021-46115

jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin.TemplateControllerdoUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code...