CVE-2021-22205

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution...

CVE-2021-22205

Removed by vendor...

CVE-2021-22205

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution. Recent assessments: jbaines-r7 at November 01, 2021 2:33pm UTC reported:...

CVE-2021-22205: Improper Control of Generation of Code

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution...

PT-2021-4979

Name of the Vulnerable Software and Affected Versions GitLab versions 11.9 through 13.10.2 GitLab CE/EE versions prior to 14.0 Description The issue is related to insufficient input validation in GitLab when parsing image files, allowing remote command execution. This has been exploited in...

CVE-2021-0265: Improper Neutralization of Special Elements used in an OS Command

An unvalidated REST API in the AppFormix Agent of Juniper Networks AppFormix allows an unauthenticated remote attacker to execute commands as root on the host running the AppFormix Agent, when certain preconditions are performed by the attacker, thus granting the attacker full control over the...

OTRS 6.0.1 Remote Command Execution

Exploit Title: OTRS 6.0.1 - Remote Command Execution 2 Date: 21-04-2021 Exploit Author: Hex26 Vendor Homepage: https://www.otrs.com/ Software Link: http://ftp.otrs.org/pub/otrs/ Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 Tested on: OTRS 5.0.2/CentOS 7.2.1511 CVE : CVE-2017-16921...

OTRS 6.0.1 - Remote Command Execution (2)

Exploit Title: OTRS 6.0.1 - Remote Command Execution 2 Date: 21-04-2021 Exploit Author: Hex26 Vendor Homepage: https://www.otrs.com/ Software Link: http://ftp.otrs.org/pub/otrs/ Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 Tested on: OTRS 5.0.2/CentOS 7.2.1511 CVE : CVE-2017-16921...

OTRS 6.0.1 - Remote Command Execution Exploit (2)

Exploit Title: OTRS 6.0.1 - Remote Command Execution 2 Exploit Author: Hex26 Vendor Homepage: https://www.otrs.com/ Software Link: http://ftp.otrs.org/pub/otrs/ Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1 Tested on: OTRS 5.0.2/CentOS 7.2.1511 CVE : CVE-2017-16921 !/usr/bin/env python3...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

CSRF-to-RCE ..| CVE-2021-31762 |.. Description : Exploit...

Exploit for Cross-site Scripting in Webmin

CVE-2021-31761 Description : Exploiting a Reflected Cross-S...

Exploit for Cross-site Scripting in Webmin

..| CVE-2021-31761 |.. Description : Exploiting a Reflected...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

..| CVE-2021-31760 |.. Description : Exploiting a Cross-sit...

Exploit for Cross-Site Request Forgery (CSRF) in Webmin

..| CVE-2021-31760 |.. Description : Exploiting a Cross-sit...

cisco RV34X系列身份绕过和远程命令执行漏洞（CVE-2021-1472 CVE-2021-1473）

Advisory: Cisco RV34X Series – Authentication Bypass and Remote Command Execution APRIL 13, 2021 TL;DR In early 2021, we reported a few security issues to Cisco related to their RV34X series of routers, two of which have been recently patched. The issues in question were an authentication bypass...

GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GravCMS Remote Command Execution', 'Description' = %q This module exploits arbitrary config write/update vulnerability to achieve remote code...

GravCMS 1.10.7 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GravCMS Remote Command Execution', 'Description' = %q This module exploits arbitrary config write/update vulnerability to achieve remote code...

Askey Fiber Optic Router Unauthorized RCE Vulnerability

Askey is the world's first professional manufacturer of international network communication equipments, the main products are ADSL, Cable, Modem, ADSL Router, Cable Router and so on. The main products are ADSL, Cable Modem, ADSL Router, Cable Router and so on. The Askey Fiber Optic Router...

GravCMS 1.10.7 - Unauthenticated Arbitrary File Write (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GravCMS Remote Command Execution', 'Description' = %q This module exploits arbitrary config write/update vulnerability to achieve remote code...

Cockpit CMS 0.11.1 NoSQL Injection / Remote Command Execution Exploit

This Metasploit module exploits two NoSQL injection vulnerabilities to retrieve the user list and password reset tokens from the system. Next, the USER is targeted to reset their password. Then, a command injection vulnerability is used to execute the payload. While it is possible to upload a...