3119 matches found
CVE-2024-51485
Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change...
PT-2024-10020
The Linux kernel's ksmbd server is affected by a slab-use-after-free issue in the ksmbd smb2 session create function, caused by a race condition between ksmbd smb2 session create and ksmbd expire session. This issue can be exploited to impact the confidentiality, integrity, and availability of...
HikaShop, 5.1.3, Other ACL
Update to Hikashop 5.1.4 . No other details on this exploit will be release...
Exploit for Improper Verification of Cryptographic Signature in Onelogin Ruby-Saml
Ruby-SAML / GitLab Authentication Bypass CVE-2024-45409 expl...
CVE-2024-9564
CVE-2024-9564 affects D-Link DIR-605L firmware (2.13B01 BETA). The vulnerability is in the function formWlanWizardSetup (file /goform/formWlanWizardSetup) where unvalidated input in the webpage argument leads to a buffer overflow. This can be triggered remotely and, per the disclosures, an exploi...
USN-7052-1: GNOME Shell vulnerabilities
It was discovered that GNOME Shell mishandled extensions that fail to reload, possibly leading to extensions staying enabled on the lock screen. An attacker could possibly use this issue to launch applications, view sensitive information, or execute arbitrary commands. CVE-2017-8288 It was...
PHP ACRSS 1.0 Cross Site Request Forgery
============================================================================================================================================= | Title : php acrss 1.0 CSRF Add Admin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 130.0.0 64 bits | ...
Wireshark suffers from a denial of service vulnerability (CNVD-2024-39255)
Wireshark formerly Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. Wireshark has a security vulnerability that can be exploited by an attacker to deny service via...
Unspecified vulnerability in Linux kernel (CNVD-2024-39260)
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel. An attacker could exploit this vulnerability to cause a resource access conflict...
Exploit for Command Injection in Jc21 Nginx_Proxy_Manager
POCCVE-2024-46256 CVE-2024-46256 and CVE-2024-46257 is the...
CVE-2024-25270
An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference IDOR vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data...
Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow
CVE-2024-37084-Poc Setup ,Analysis , Demo exploit and poc abou...
GHSA-7Q74-G774-7X3G Interchain Security: The signers of ICS messages do not need to match the provider address
Context ICS has the following four messages that enable validators on the provider chain to perform different actions: - MsgOptIn -- adds a validator to the consumer chain’s active set - MsgOptOut -- removes a validator from the consumer chain’s active set - MsgAssignConsumerKey -- changes the...
Linux Kernel 5.6.13 Use-After-Free Exploit
Proof of concept exploit that uses a use-after-free vulnerability due to a race condition in MIDI devices in Linux Kernel version 5.6.13. // gcc -o exploit exploit.c -masm=intel -static -s -lpthread define GNUSOURCE include include include include include include include include include include...
Wordpress LiteSpeed Cache plugin cookie theft
This module exploits an unauthenticated account takeover vulnerability in LiteSpeed Cache, a Wordpress plugin that currently has around 6 million active installations. In LiteSpeed Cache versions prior to 6.5.0.1, when the Debug Logging feature is enabled, the plugin will log admin cookies to the...
Kaillera 0.86 Server Denial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Kaillera 0.86 Server Denial of Service' , 'Description' = %q The Kaillera 0.86 server can be shut down by sending any malformed packet after the...
FIWARE Keyrock Encryption Problem Vulnerability (CNVD-2024-37461)
FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the algorithm used to create the disable2fakey being predictable, and can be exploited by an attacker to predict...
Courier Management System 1.0 Cross Site Request Forgery
============================================================================================================================================= | Title : Courier Management System 1.0 CSRF add admin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...
Multi-Vendor Online Groceries Management System 1.0 Cross Site Request Forgery
============================================================================================================================================= | Title : Multi-Vendor Online Groceries Management System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozill...