Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

CVE-2020-24986: Unrestricted Upload of File with Dangerous Type

Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands...

CVE-2020-3453: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system OS as a restricted user. For more information...

CVE-2020-24948

The aoccssimport AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution...

CVE-2020-24948

The aoccssimport AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution...

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

Privilege escalation

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

CVE-2020-24948

The aoccssimport AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution...

CVE-2020-24948

The data in connected documents confirms a vulnerability in the Autoptimize WordPress plugin prior to 2.7.8 where the ao_ccss_import AJAX flow does not validate that an uploaded archive is a legitimate ZIP, enabling high-privilege users to upload arbitrary files (e.g., PHP) and trigger Remote Cod...

CVE-2020-24949

CVE-2020-24949 affects PHP-Fusion 9.03.50 in downloads/downloads.php, where an authenticated non-admin user can send a crafted request to trigger remote code execution. The underlying issue enables arbitrary code execution on the server, with the vulnerability classified as high severity (CVSS v3...

CVE-2020-24949

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

Exploit for Improper Access Control in Elasticsearch

欢迎各位大佬提BUG,当前版本 AssetScanV1.3 周期 初版：2019年11月28日 V1.0初版编写完成 修改1：2019年12月02日 感谢Shadow·J反馈kali下文件导入异常 修改2：2019年12月03日 V1.1发布，新增ARP存活检测（回滚，测bug） 修改3：2019年12月04日 V1.2发布，修复漏洞脚本异常，修复weblogic脚本 修改4：2019年12月05日 V1.2修改，感谢sevck提供设计思路以及代码不规范问题 修改5：2019年12月05日 V1.2修改，修复IP数据处理异常 修改6：2019年12月19日...

CVE-2020-24949: Undefined Security Weakness

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution RCE...

CVE-2020-24948: Unrestricted Upload of File with Dangerous Type

The aoccssimport AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution...

PT-2020-21275

Name of the Vulnerable Software and Affected Versions smartsearchwp versions all Description The issue concerns malicious code intended to steal credentials from websites by traversing DOM elements to find fields such as username and password and uploading them to a remote server. It also has the...

PT-2020-3852

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV340 Series Routers affected versions not specified Description: The issue is related to a buffer overflow in the memory of the web-based management interface of Cisco Small Business RV340 Series Routers. This could allo...

PT-2020-15865

Name of the Vulnerable Software and Affected Versions Autoptimize Wordpress Plugin version 2.7.6 Description The issue arises from the ao ccss import AJAX call, which fails to verify if the uploaded file is a legitimate Zip file. This allows high-privilege users to upload arbitrary files, includi...

PT-2020-15866

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description The issue allows an authenticated user to send a crafted request to the server, enabling them to perform remote command execution. This is a result of a privilege escalation flaw in the...

PT-2020-21000

Name of the Vulnerable Software and Affected Versions browserift version 16.3.3 Description The issue concerns malicious code in the preinstall script of the affected software, which acts as a backdoor. This backdoor opens a connection to a remote server and executes incoming commands on both Uni...