DLA-3691-1 spip - security update

Bulletin has no description...

Debian: Security Advisory (DLA-3691-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the SPIP content management system, related to the restoration of unreliable data in memory, allows a hacker to execute arbitrary code.

The vulnerability of the SPIP content management system is related to the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using specially created data transmitted to the application...

Exploit for Deserialization of Untrusted Data in Spip

This is a proof of concept CVE-2023-27372 SPIP RCE vulnerabi...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2023-27372 - The vulnerability exists in the oubli parame...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2023-27372 - The vulnerability exists in the oubli parame...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2023-27372-POC Overview This Python POC Proof of Con...

Exploit for Deserialization of Untrusted Data in Spip

This PoC was wrote quickly, it's nothing special. This e...

Exploit for Deserialization of Untrusted Data in Spip

This PoC was wrote quickly, it's nothing special. This e...

SPIP v4.1.10 - Spoofing Admin account Vulnerability

Exploit Title: spip v4.1.10 - Spoofing Admin account Author: nu11secur1ty Vendor: https://www.spip.net/enrubrique25.html Software: https://files.spip.net/spip/archives/spip-v4.1.10.zip Reference: https://www.crowdstrike.com/cybersecurity-101/spoofing-attacks/ Description: The malicious user can...

spip v4.1.10 - Spoofing Admin account

Exploit Title: spip v4.1.10 - Spoofing Admin account Author: nu11secur1ty Date: 06.29.2023 Vendor: https://www.spip.net/enrubrique25.html Software: https://files.spip.net/spip/archives/spip-v4.1.10.zip Reference: https://www.crowdstrike.com/cybersecurity-101/spoofing-attacks/ Description: The...

SPIP v4.2.0 - Remote Code Execution (Unauthenticated) Exploit

!/usr/bin/env python3 -- coding: utf-8 -- Exploit Title: SPIP v4.2.1 - Remote Code Execution Unauthenticated Google Dork: inurl:"/spip.php?page=login" Exploit Author: nuts7 https://github.com/nuts7/CVE-2023-27372 Vendor Homepage: https://www.spip.net/ Software Link:...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2023-27372 SPIP -v -o report.txt 🔍 Reconnaissance M...

SPIP password reset serialization vulnerability

Added: 06/23/2023 Background SPIP is a web-based publishing system written in PHP. Problem Mishandling of serialized data in SPIP's password reset form allows remote attackers to execute arbitrary commands. Resolution Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, 4.2.1 or higher. References...

SPIP password reset serialization vulnerability

Added: 06/23/2023 Background SPIP is a web-based publishing system written in PHP. Problem Mishandling of serialized data in SPIP's password reset form allows remote attackers to execute arbitrary commands. Resolution Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, 4.2.1 or higher. References...

SPIP 4.2.1 Remote Code Execution

!/usr/bin/env python3 -- coding: utf-8 -- Exploit Title: SPIP v4.2.1 - Remote Code Execution Unauthenticated Google Dork: inurl:"/spip.php?page=login" Date: 19/06/2023 Exploit Author: nuts7 https://github.com/nuts7/CVE-2023-27372 Vendor Homepage: https://www.spip.net/ Software Link:...

SPIP v4.2.0 - Remote Code Execution (Unauthenticated)

!/usr/bin/env python3 -- coding: utf-8 -- Exploit Title: SPIP v4.2.1 - Remote Code Execution Unauthenticated Google Dork: inurl:"/spip.php?page=login" Date: 19/06/2023 Exploit Author: nuts7 https://github.com/nuts7/CVE-2023-27372 Vendor Homepage: https://www.spip.net/ Software Link:...

Exploit for Deserialization of Untrusted Data in Spip

---- CVE-2023-273...

VulnCheck KEV: CVE-2023-27372

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1...

Metasploit Weekly Wrap-Up

VMware Workspace ONE Access exploit chain A new module contributed by jheysel-r7 exploits two vulnerabilities in VMware Workspace ONE Access to attain Remote Code Execution as the horizon user. First being CVE-2022-22956, which is an authentication bypass and the second being a JDBC injection in...