Zoho Password Manager Pro XML-RPC Java Deserialization

This module exploits a Java deserialization vulnerability in Zoho ManageEngine Pro before 12101 and PAM360 before 5510. Unauthenticated attackers can send a crafted XML-RPC request containing malicious serialized data to /xmlrpc to gain RCE as the SYSTEM user. Module Options msf use...

CVE-2021-41635: Incorrect Default Permissions

When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system...

PT-2022-11445

Name of the Vulnerable Software and Affected Versions MELAG FTP Server version 2.2.0.4 Description The issue allows remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system when MELAG FTP Server is installed as a Windows service and run...

CVE-2022-28784

Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The patch addresses incorrect implementation of file path validation check logic...

CVE-2022-28784

Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The patch addresses incorrect implementation of file path validation check logic...

CVE-2022-28784

Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The patch addresses incorrect implementation of file path validation check logic...

CVE-2022-28784: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to list file names in arbitrary directory as system user. The patch addresses incorrect implementation of file path validation check logic...

Samsung SMR 路径遍历漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. Samsung SMR has a security vulnerability that originates from a path traversal vulnerability in Galaxy Themes. An attacker exploits the vulnerability to list the filename in an...

PT-2022-19232

Name of the Vulnerable Software and Affected Versions Galaxy Themes versions prior to SMR May-2022 Release 1 Description The issue is related to a path traversal vulnerability that allows attackers to list file names in an arbitrary directory as a system user. This is due to an incorrect...

CVE-2022-24767

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

Code injection

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

CVE-2022-24767

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

CVE-2022-24767

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

CVE-2022-24767: Uncontrolled Search Path Element

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account...

PT-2022-13523

Name of the Vulnerable Software and Affected Versions Logitech Sync for Windows versions prior to 2.4.574 Description The issue is related to a Time-of-check Time-of-use TOCTOU Race Condition, which may allow escalation of permission to the system user if successfully exploited. Recommendations F...

CVE-2022-27960

Insecure permissions configured in the userid parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information...

Dell Technologies Dell PowerScale OneFS 安全漏洞

Dell PowerScale OneFS is the PowerScale OneFS operating system that provides horizontal scaling NAS. A security vulnerability exists in Dell PowerScale OneFS that originates from a remote file system user with a local account that could be exploited by an attacker to cause escalation of file...

CVE-2022-22996

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user...

CVE-2022-22996

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user...

CVE-2022-23869

In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request...