GodOfWar - Malicious Java WAR Builder With Built-In Payloads

A command-line tool to generate war payloads for penetration testing / red teaming purposes, written in ruby. Features Preexisting payloads. try -l/--list cmdget filebrowser bindshell reverseshell reverseshellui Configurable backdoor. try --host/-port Control over payload name. To avoid malicious...

Microsoft Windows - Contact File Format Arbitary Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'fileutils' require 'rex/zip' class MetasploitModule 'Microsoft Windows Contact File Format Arbitary Code Execution', 'Description' = %q This vulnerability allow...

Magento SQL Injection Vulnerability

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions. A SQL injection vulnerability exists in Magento, which stems from a lack of validation of externally entered SQL...

The vulnerability of the run_command function in the Git distributed version control system allows a hacker to execute arbitrary commands.

The vulnerability of the runcommand programming interface in a distributed version control system like Git is related to insufficient cleaning of input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

Design/Logic Flaw

On D-Link DAP-1530 A1 before firmware version 1.06b01, DAP-1610 A1 before firmware version 1.06b01, DWR-111 A1 before firmware version 1.02v02, DWR-116 A1 before firmware version 1.06b03, DWR-512 B1 before firmware version 2.02b01, DWR-711 A1 through firmware version 1.11, DWR-712 B1 before...

Microsoft Office Access Connectivity Engine Input Validation Error Vulnerability (CNVD-2019-27312)

Microsoft Office is a U.S. Microsoft Microsoft company's office software suite of products. Common components of the product include Word, Excel, Access, Powerpoint, FrontPage, etc. Office Access Connectivity Engine is one of the database connection engine. A remote code execution vulnerability...

Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CNVD-2019-10377)

Microsoft ChakraCore and Microsoft Edge are both products of Microsoft Corporation.ChakraCore is the core of an open-source Chakra JavaScript scripting engine used in the Edge browser, and is also available as a standalone JavaScript engine. Microsoft Edge is a web browser that comes with Windows...

Remote code execution

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'...

The vulnerability of the Expedition Migration tool, which exists due to the lack of measures taken to protect the website structure, allows a hacker to execute arbitrary JavaScript or HTML code.

The vulnerability of the Network Configuration Transfer tool exists because no measures have been taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript or HTML code remotely...

TeemIp IPAM 2.4.0 - new_config Command Injection (Metasploit)

TeemIp IPAM 2.4.0 - newconfig Command Injection Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "TeemIp IPAM %q This module exploits a command injection vulnerability in TeemIp versio...

TeemIp IPAM Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "TeemIp IPAM %q This module exploits a command injection vulnerability in TeemIp versions prior to 2.4.0. The "newconfig" parameter of "exec.php"...

AIDA64 Business 5.99.4900 - SEH Buffer Overflow (EggHunter)

AIDA64 Business 5.99.4900 - SEH Buffer Overflow EggHunter !/usr/bin/python Exploit Title: AIDA64 Business 5.99.4900 - SEH Buffer Overflow EggHunter Date: 2019-04-01 Vendor Homepage: https://www.aida64.com Software Link: https://www.aida64.com/downloads Mirror Link :...

Synology DiskStation Manager Command Injection Vulnerability (CNVD-2019-08956)

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A command injection vulnerability exists in ftpd in Synology DSM versions pri...

TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "TeemIp IPAM %q This module exploits a command injection vulnerability in TeemIp versions prior to 2.4.0. The "newconfig" parameter of "exec.php"...

CVE-2018-1640

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force I...

Advantech WebAccess Node bwrunrpt Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within bwrunrpt.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs...

CVE-2018-13284

Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...

VulnCheck KEV: CVE-2019-0666

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665, CVE-2019-0667, CVE-2019-0772...

Multiple Command Injection Vulnerabilities in Grandstream Products

Multiple Vulnerabilities in Grandstream devices. - The affected devices are: GAC2500, GVC3202, GXP2200, GXV3275, GXV3240, GXV3611IRHD, GXV3611IRHD, GXV3611IRHD, UCM6204, GXV3370, WP820, GWN7000, & GWN7610. - A remote command execution vulnerability exists in the 'priority' and 'logserver'...

CVE-2019-10660

The CVE-2019-10660 affects Grandstream GXV3611IR_HD devices, documented as vulnerable before firmware 1.0.3.23. A remote attacker with authentication can execute arbitrary code by supplying shell metacharacters in the logserver field of the /goform/systemlog API. The issue is a remote code execut...