545 matches found
Exploit for Command Injection in Mjdm Majordomo
Deep Dive: CVE-2023-50917 - Unmasking an Unauthenticated Remo...
Exploit for Classic Buffer Overflow in Draytek Vigor3910_Firmware
CVE-2022-32548-RCE-POC DrayTek unauthenticated remote code exe...
Cisco IOX XE Unauthenticated RCE Chain
This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute a payload with root privileges. The vulnerable IOS XE versions are: 16.1.1, 16.1.2, 16.1.3, 16.2.1, 16.2.2, 16.3.1, 16.3.2,...
Metasploit Weekly Wrap-Up
Pollution in Kibana This week, contributor h00die added a module that leverages a prototype pollution bug in Kibana prior to version 7.6.3. Particularly, this issue is within the Upgrade Assistant and enables an attacker to execute arbitrary code. This vulnerability can be triggered by sending a...
CVE-2023-4521 Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
The Import XML and RSS Feeds WordPress plugin before 2.1.5 contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue...
Exploit for Incorrect Authorization in Cacti
CVE-2022-46169 PoC - Unauthenticated RCE in Cacti 1.2.22 This...
Exploit for Command Injection in Frangoteam Fuxa
Unauthenticated RCE FUXA CVE-2023-33831 The vulnerability affe...
Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
Description The plugin contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42 and not deletin...
Siemens A8000 CP-8050 / CP-8031 Code Execution / Command Injection
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities including Unauthenticated RCE product: Siemens A8000 CP-8050 MASTER MODULE 6MF2805-0AA00 Siemens A8000 CP-8031 MASTER MODULE 6MF2803-1AA00...
CVE-2023-37170
TOTOLINK A3300R (V17.0.0cu.557_B20221024) is affected by CVE-2023-37170: an unauthenticated remote code execution via the lang parameter in the setLanguageCfg function. The vulnerability is described in multiple sources as a code execution condition stemming from improper handling of input in the...
Exploit for Command Injection in Vmware Aria_Operations_For_Networks
CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations f...
Exploit for SQL Injection in Progress Moveit_Cloud
It is an exploit module for MOVEit Transfer. The vulnerability i...
Vulnerabilities fixed in Fortinet FortiGate
Fortinet has released updates to its FortiGate software. Security researchers indicate that in these updates a serious vulnerability has been fixed in the VPN-SSL. A malicious party could exploit the vulnerability to execute arbitrary code without prior authentication to execute arbitrary code on...
PT-2023-17682 · Undefined · Undefined
Исследователи начинают раскрывать результаты своей работы, которые демонстрировались в рамках хакерского турнира Pwn2Own, проведенного ZDI в декабре прошлого года. Не отстают и поставщики, правда не все. Исследователь Нгуен Хоанг Тхоч из STAR Labs опубликовал подробности двух уязвимостей в VMWare...
CVE-2023-21932
Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications component: OXI. The supported version that is affected is 5.6. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...
Exploit for Improper Privilege Management in Openwebanalytics Open_Web_Analytics
CVE-2022-24637 Unauthenticated RCE in Open Web Analytics versi...
Metasploit Weekly Wrap-Up
Zxyel Routers Beware This week we've released a module written by first time community contributor shr70 that can exploit roughly 45 different Zyxel router and VPN models. The module exploits a buffer overflow vulnerability that results in unauthenticated remote code execution on affected devices...
CVE-2023-0090 Proofpoint Enterprise Protection webservices unauthenticated RCE
The webservices in Proofpoint Enterprise Protection PPS/POD contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all...
