PHP Laravel Framework Token Unserialize Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PHP Laravel Framework token Unserialize Remote Command Execution', 'Description' = %q This module exploits a vulnerability in the PHP Laravel...

PHP Laravel Framework Token Unserialize Remote Command Execution Exploit

This Metasploit module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x up to 5.6.29. Remote command execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to an insecure unserialize call of the decrypt method in...

Tyto Software Sahi Pro Remote Command Execution Vulnerability

Tyto Software Sahi Pro is a suite of automated testing tools from Tyto Software India. A remote command execution vulnerability exists in s/sprm/s/dyn/PlayersetScriptFile in Tyto Software Sahi Pro version 8.0.0. The vulnerability can be exploited by an attacker to execute commands with the help o...

DEBIAN-CVE-2019-13574

In lib/minimagick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernelopen, which accepts a '|' character followed by a command...

UBUNTU-CVE-2019-13574

In lib/minimagick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernelopen, which accepts a '|' character followed by a command...

Input validation

In lib/minimagick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernelopen, which accepts a '|' character followed by a command...

CVE-2019-13574

The CVE concerns MiniMagick before 4.9.4: in lib/mini_magick/image.rb, a fetched remote image filename could be passed directly to Kernel.open, with the leading ‘|’ indicating a shell command, enabling remote command execution. Connected advisories confirm the issue is a remote command execution ...

Sahi Pro 8.0.0 - Remote Command Execution Exploit

Exploit for java platform in category web applications Exploit Title: Sahi Pro V8.0.0 - Unauthenticated Remote Command Execution Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://sahipro.com Software Link:...

Sahi Pro 8.0.0 - Remote Command Execution

Sahi Pro 8.0.0 - Remote Command Execution Exploit Title: Sahi Pro V8.0.0 - Unauthenticated Remote Command Execution Date: 2019-07-12 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://sahipro.com Software Link:...

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass / Remote Command Execution Exploit

Exploit for cgi platform in category web applications Exploit Title: Citrix SD-WAN Appliance 10.2.2 Auth Bypass and Remote Command Execution Exploit Author: Chris Lyne @lynerc Vendor Homepage: https://www.citrix.com Product: Citrix SD-WAN Software Link:...

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass / Remote Command Execution

Exploit Title: Citrix SD-WAN Appliance 10.2.2 Auth Bypass and Remote Command Execution Date: 2019-07-12 Exploit Author: Chris Lyne @lynerc Vendor Homepage: https://www.citrix.com Product: Citrix SD-WAN Software Link: https://www.citrix.com/downloads/citrix-sd-wan/ Version: Tested against 10.2.2...

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass Remote Command Execution

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass Remote Command Execution Exploit Title: Citrix SD-WAN Appliance 10.2.2 Auth Bypass and Remote Command Execution Date: 2019-07-12 Exploit Author: Chris Lyne @lynerc Vendor Homepage: https://www.citrix.com Product: Citrix SD-WAN Software Link:...

CVE-2019-13561

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the onlinefirmwarecheck.cgi checkfwurl parameter...

CVE-2019-13561

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the onlinefirmwarecheck.cgi checkfwurl parameter...

Multiple Remote Command Execution Vulnerabilities in USR-LTE-7S4 V2

Jinan Arata Networking Technology Co., Ltd. is a technology company that makes serial networking modules. Multiple remote command execution vulnerabilities exist in the 4G module USR-LTE-7S4 V2 in Jinan Youjin Networking Technology Co. This allows an attacker to remotely execute commands...

Advantech WebAccessNode suffers from a command execution vulnerability (CNVD-2019-23512)

Advantech is a leader in the intelligent systems industry. A command execution vulnerability exists in Advantech WebAccessNode. It allows attackers to remotely execute commands to gain server privileges...

The vulnerability of the Heketi software lies in the absence of an authentication procedure in the standard settings, allowing a perpetrator to execute arbitrary commands.

The vulnerability of the Heketi network software is related to the absence of an authentication process in the standard settings. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands supported by the Heketi Server API using the Heketi CLI comma...

Siemens TIA Portal - Remote Command Execution

Exploit Title: Siemens TIA Portal unauthenticated remote command execution Date: 06/11/2019 Exploit Author: Joseph Bingham CVE : CVE-2019-10915 Vendor Homepage: www.siemens.com Software Link: https://new.siemens.com/global/en/products/automation/industry-software/automation-software/tia-portal.ht...

Apache axis remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net

Recently, convinced that the server found the Apache axis component remote command execution exploit way. The vulnerability is essentially due to the administrator for the AdminService configuration error, when enableRemoteAdmin property is set to true, the attacker can remotely use of the...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...