KiTTY 0.76.1.13 Command Injection Exploit

KiTTY versions 0.76.1.13 and below suffer from a command injection vulnerability when getting a remote file through scp. It appears to leverage an ANSI escape sequence issue which is quite an interesting vector of attack. !/usr/bin/python...

KiTTY 0.76.1.13 Command Injection

!/usr/bin/python ---------------------------------------------------------------------------------------- Exploit: KiTTY ≤ 0.76.1.13 Command Injection Vulnerability in KiTTY Get Remote File Through SCP Input CVE-2024-23749 OS: Microsoft Windows 11/10/8/7/XP Author: DEFCESCO Austin A. DeFrancesco...

CVE-2024-1264

Juanpao JPShop up to version 1.5.02 is affected. The vulnerability resides in the function actionUpdate of /api/controllers/common/UploadsController.php, where manipulating the argument imgage enables unrestricted file uploads. Exploitation is remote and publicly disclosed. Affected versions: JPS...

Remote file inclusion

Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauthorized access to sensitive information...

Gradio Path Traversal vulnerability

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request...

Remote file inclusion

MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered...

PT-2024-13904 · Ibm · Ibm Powersc

Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to the use of insecure HTTP methods, which could allow a remote attacker to perform unauthorized file request modification. Recommendations: For versions 1.3 through 2.1,...

CVE-2024-1113 openBI Unity.php uploadUnity unrestricted upload

A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/controller/Unity.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The...

CVE-2024-1005

A vulnerability has been found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This vulnerability affects unknown code of the file /runtime/log. The manipulation leads to files or directories accessible. The attack can be initiated remotely. The exploit has been...

CVE-2024-0783

CVE-2024-0783 affects Project Worlds Online Admission System 1.0, with a vulnerability in the processing of the file documents.php that enables unrestricted file upload. The issue can be exploited remotely and has been widely reported across multiple feeds (e.g., Red Hat, Vulners-related enrichme...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools for installation work on production lines allows a hacker to delete any files from the file system at will.

The vulnerability of the NEXO-OS operating system for tools used in production line assembly work, such as the Bosch Nexo cordless nutrunner and the Bosch Nexo special cordless nutrunner, is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a remote attacker...

CVE-2024-0728

A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument ccmodel leads to file inclusion. The attack can be launched remotely. The exploit has been disclos...

CVE-2024-0728

A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument ccmodel leads to file inclusion. The attack can be launched remotely. The exploit has been disclos...

CVE-2024-0728

ForU CMS (up to 2020-06-23) contains a file inclusion vulnerability in channel.php triggered by manipulating the c_cmodel parameter. This affects an unknown functionality within channel.php and can be exploited remotely; the exploit has been disclosed publicly (VDB-251551). Several sources (NVD, ...

actidata actiNAS SL 2U-8 RDX Security Vulnerability

The actidata actiNAS SL 2U-8 RDX is a rackmount backup server from actidata. A security vulnerability exists in the actidata actiNAS SL 2U-8 RDX version 3.2.03-SP1, which originated from a vulnerability that allows remote attackers to list files hosted by a web application...

CVE-2024-20272

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a...

CVE-2024-0315

Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious PDF file to the system during the report creation process...

CVE-2024-0315

Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious PDF file to the system during the report creation process...

Remote file inclusion

Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious PDF file to the system during the report creation process...

CVE-2024-0315 Remote file inclusion vulnerability in FireEye Central Management

Remote file inclusion vulnerability in FireEye Central Management affecting version 9.1.1.956704. This vulnerability allows an attacker to upload a malicious PDF file to the system during the report creation process...