1174 matches found
PHOENIX CONTACTs WP 6xxx series web panels Operating System Command Injection Vulnerability
PHOENIX CONTACTs WP 6xxx series web panels are a series of web panels from PHOENIX CONTACTs, Germany. An operating system command injection vulnerability exists in PHOENIX CONTACTs WP 6xxx series web panels versions prior to 4.0.10, which originates from a low-privileged remote attacker who may b...
Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets
In yet another sign of a lucrative crimeware-as-a-service CaaS ecosystem, cybersecurity researchers have discovered a new Windows-based information stealer called Meduza Stealer that's actively being developed by its author to evade detection by software solutions. "The Meduza Stealer has a...
PT-2023-5686 · Unknown · Control Web Panel
Name of the Vulnerable Software and Affected Versions: Control Web Panel CWP affected versions not specified Description: The issue is related to a lack of proper authentication in the web interface of Control Web Panel, allowing remote attackers to execute arbitrary code on affected installation...
PT-2023-5687 · Unknown · Control Web Panel
Name of the Vulnerable Software and Affected Versions: Control Web Panel affected versions not specified Description: The issue is related to the lack of proper validation of a user-supplied string before using it to execute a system call in the cwpsrv process, which listens on the loopback...
PT-2023-5685 · Unknown · Control Web Panel
Name of the Vulnerable Software and Affected Versions: Control Web Panel affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. The specific flaw exists within the dns zone editor module, resulting...
New Atomic macOS Malware Steals Keychain Passwords and Crypto Wallets
Threat actors are advertising a new information stealer for the Apple macOS operating system called Atomic macOS Stealer or AMOS on Telegram for $1,000 per month, joining the likes of MacStealer. "The Atomic macOS Stealer can steal various types of information from the victim's machine, including...
Control Web Panel 7 (CWP7) 0.9.8.1147 Remote Code Execution
// Exploit Title: Control Web Panel 7 CWP7 v0.9.8.1147 - Remote Code Execution RCE // Date: 2023-02-02 // Exploit Author: Mayank Deshmukh // Vendor Homepage: https://centos-webpanel.com/ // Affected Versions: version 0.9.8.1147 // Tested on: Kali Linux // CVE : CVE-2022-44877 // Github POC:...
Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE)
// Exploit Title: Control Web Panel 7 CWP7 v0.9.8.1147 - Remote Code Execution RCE // Date: 2023-02-02 // Exploit Author: Mayank Deshmukh // Vendor Homepage: https://centos-webpanel.com/ // Affected Versions: version 0.9.8.1147 // Tested on: Kali Linux // CVE : CVE-2022-44877 // Github POC:...
Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution Exploit
// Exploit Title: Control Web Panel 7 CWP7 v0.9.8.1147 - Remote Code Execution RCE // Exploit Author: Mayank Deshmukh // Vendor Homepage: https://centos-webpanel.com/ // Affected Versions: version 0.9.8.1147 // Tested on: Kali Linux // CVE : CVE-2022-44877 // Github POC:...
Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution Vulnerability
Exploit Title: Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution RCE + Centos Web Panel 7 - 0.9.8.1147 + Affected Component ip:2031/login/index.php?login=$whoami + Discoverer: Numan Türle @ Gais Cyber Security + Author: Numan Türle + Vendor: https://centos-webpanel.com/ -...
The vulnerability of the Trace View web instrumentation panel in Grafana allows attackers to escalate their privileges and perform cross-site scripting attacks.
The vulnerability of the Trace View web instrumentation panel in Grafana relates to insufficient protection of the web page structure when processing values of attributes and resources within a range. Exploiting this vulnerability allows an attacker to enhance their privileges and perform...
Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)
Exploit Title: Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution RCE + Centos Web Panel 7 - 0.9.8.1147 + Affected Component ip:2031/login/index.php?login=$whoami + Discoverer: Numan Türle @ Gais Cyber Security + Author: Numan Türle + Vendor: https://centos-webpanel.com/ -...
What’s New in InsightVM and Nexpose: Q1 2023 in Review
In Q1, our team continued to focus on driving better customer outcomes with InsightVM and Nexpose by further improving efficiency and performance. While many of these updates are under the hood, you may have started to notice faster vulnerability checks available for the recent ETRs or an upgrade...
Cinoshi A Novel Malware-as-a-Service Platform
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Cinoshi is a new MaaS platform with a toolkit including a stealer, botnet, clipper, and crypto-miner. Offering free stealer and web panel is rare. To receive real-time threat advisories, please follow...
Osprey Pump Controller 1.0.1 Authentication Bypass Credentials Modification
Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...
U.S. Dept Of Defense: HAProxy stats panel exposed externally
An exposed web panel for HAProxy running on a system allowed external access to the statistics page at port 1024, potentially exposing sensitive information...
PT-2023-5684 · Unknown · Control Web Panel
Name of the Vulnerable Software and Affected Versions: Control Web Panel versions affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. The specific flaw exists within the mysql manager module,...
Control Web Panel Unauthenticated Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'CWP login.php Unauthenticated RCE', 'Description' = %q Control Web Panel versions 'Spencer McIntyre', metasploit module...
Titan Stealer: A New Golang-Based Information Stealer Malware Emerges
A new Golang-based information stealer malware dubbed Titan Stealer is being advertised by threat actors through their Telegram channel. "The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP...
Linanto Control Web Panel (CWP) 7 < 0.9.8.1147 Command Injection (CVE-2022-44877)
The version of Linanto Control Web Panel CWP 7, a web based control panel application, installed on the remote host is prior to 0.9.8.1147. It is, therefore, affected by a command injection vulnerability in the login parameter of the login/index.php page. Note that Nessus has not tested for this...