CVE-2024-41111

CVE-2024-41111 affects Sliver 1.6.0 prerelease. The issue is remote code execution on the Sliver teamserver via a low‑privileged operator, executing as root. Exploitation relies on a command-injection in the generate msf-stager flow to inject flags into msfvenom and overwrite Sliver’s own Go bina...

CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...

CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...

PT-2024-5028 · Unknown +2 · Jumpserver +2

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: The issue is related to the JumpServer Privileged Access Management PAM tool, which provides secure access to various endpoints through a web browser. An...

PT-2024-5027 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes...

CVE-2024-20296

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Policy Admin credentials on the affected...

PT-2024-5457 · Cisco · Cisco Rv345 +1

Name of the Vulnerable Software and Affected Versions: Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers affected versions not specified Description: A vulnerability in the upload module could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This issue is...

PT-2024-5455 · Cisco · Cisco Secure Web Appliance +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Web Appliance versions affected versions not specified Description: The issue is related to insufficient validation of user-supplied input for the Command Line Interface CLI of Cisco AsyncOS for Secure Web Appliance. This could...

Unspecified Vulnerability in Magic R230 of Xinhua San Technologies Ltd.

Magic R230 is a wireless router from China's Xinhua San H3C. A security vulnerability exists in the Magic R230 V100R002 of Xinhua San Technologies Co. The vulnerability stems from a hard-coded password vulnerability in /etc/shadow, which can be exploited by an attacker to log in as root...

cups: Cupsd Listen arbitrary chmod 0140777

A flaw was found in the cupsd server. When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Since cupsd is often running as root, this...

CVE-2024-35338

Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root...

PT-2024-8105 · Unknown · Data Center Expert

Name of the Vulnerable Software and Affected Versions: Data Center Expert affected versions not specified Description: The issue is related to an improper verification of cryptographic signature, which could compromise the Data Center Expert software. This vulnerability allows an attacker to...

Exploit for Code Injection in Vmware Cloud_Foundation

Privilege Escalation: VMware vCenter Server Authenticated RCE...

CVE-2024-39524

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI doesn't properly handle...

CVE-2024-39523

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI doesn't properly handle...

CVE-2024-39521

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI doesn't properly handle...

CVE-2024-39520

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI doesn't properly handle...

PT-2024-28518 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions prior to 20.4R3-S7-EVO Junos OS Evolved versions 21.2-EVO prior to 21.2R3-S8-EVO Junos OS Evolved versions 21.4-EVO prior to 21.4R3-S7-EVO Junos OS Evolved versions 22.2-EVO prior to 22.2R3-EVO Junos OS Evolved...

(Pwn2Own) Synology BC500 Protection Mechanism Failure Software Downgrade Vulnerability

This vulnerability allows network-adjacent attackers to downgrade Synology software on affected installations of Synology BC500 cameras. Authentication is required to exploit this vulnerability. The specific flaw exists within the update functionality. The issue results from the lack of proper...

(Pwn2Own) Synology BC500 synocam_param.cgi Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology BC500 cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the synocamparam.cgi module. The issue results from the lack of proper...