239 matches found
Helmholz REX 跨站脚本漏洞
Helmholz REX is a series of routers from Helmholz. A cross-site scripting vulnerability exists in the Helmholz REX 200 and REX 250, which stems from the ability to store an arbitrary JavaScript load on the device's diagnostic page...
CVE-2021-22283
Improper Initialization vulnerability in ABB Relion protection relays - 611 series, ABB Relion protection relays - 615 series IEC 4.0 FP1, ABB Relion protection relays - 615 series CN 4.0 FP1, ABB Relion protection relays - 615 series IEC 5.0, ABB Relion protection relays - 615 series IEC 5.0 FP1...
PT-2022-6575 · NetGear · Netgear Rax30
Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 affected versions not specified Description: The issue is related to the handling of JSON data and results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based...
CVE-2022-43563
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phis...
CVE-2022-43563
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phis...
Design/Logic Flaw
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phis...
CVE-2022-43563 Risky command safeguards bypass via rex search command field names in Splunk Enterprise
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phis...
PT-2022-26966 · Splunk · Splunk Enterprise
Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 8.2.9 Splunk Enterprise versions prior to 8.1.12 Description: The issue arises from how the rex search command handles field names, allowing an attacker to bypass SPL safeguards for risky commands. This...
Splunk Enterprise 8.1 < 8.1.12, 8.2.0 < 8.2.9 (SVD-2022-1103)
The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2022-1103 advisory. - In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex' search command handles field names lets an attack...
CVE-2022-31568
The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31568
The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
Path traversal
The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...
CVE-2022-31568
The CVE-2022-31568 entry concerns the Rexians/rex-web project, where absolute path traversal is possible due to unsafe use of Flask send_file. This is confirmed across sources (NVD, Red Hat, CVE List, CNNVD) with descriptions indicating the vulnerability stems from improper handling of file paths...
rex-web 路径遍历漏洞
rex-web is a Rexians community website open-sourced by Rexians. A security vulnerability exists in rex-web, which stems from an insecure use of the Flask sendfile function...
Metasploit Weekly Wrap-Up
SAMR Auxiliary Module A new SAMR auxiliary module has been added that allows users to add, lookup, and delete computer accounts from an AD domain. This should be useful for pentesters on engagements who need to create an AD account to gain an initial foothold into the domain for lateral movement...
MAL-2022-5776 Malicious code in rex-design (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08797fcedbfba6352f704ba60e5df06ca756270b1fedabe5eb83784ae13a5395 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in rex-design (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08797fcedbfba6352f704ba60e5df06ca756270b1fedabe5eb83784ae13a5395 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Metasploit Wrap-Up
Dump Windows secrets from Active Directory This week, our very own Christophe De La Fuente added an important update to the existing Windows Secret Dump module. It is now able to dump secrets from Active Directory, which will be very useful for Metasploit users. This new feature uses the Director...
Native LDAP Server (Example)
This module provides a Rex based LDAP service to expose the native Rex LDAP server functionality created during log4shell development. Module Options msf use auxiliary/server/ldap msf auxiliaryldap show actions ...actions... msf auxiliaryldap set ACTION msf auxiliaryldap show options ...show and...
