Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to...

Command Injection

Overview snyk-gradle-plugin is a plugin for the Snyk CLI tool, providing dependency metadata for Gradle projects. Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attackers to run arbitrary commands on t...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to an incomplete fix for CVE-2022-40764. A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to...

Docker Desktop Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Exploit for CVE-2022-21350

It is an offensive tool for Java-based web applications. The rep...

Exploit for OS Command Injection in Docker

This is a PoC Proof of Concept exploit for CVE-2019-5736, a vulnerability in the runc binary of the Docker container runtime. The exploit is implemented in Go and is designed to overwrite the runc binary on the host system from within a container. The exploit works by overwriting the /bin/sh bina...

Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite

Explotación Activa Sobre Zimbra CVE-2022-37042 RCE Unauthent...

org.apache.pulsar:distribution (>=2.0.0-rc1-incubating, <=2.0.1-incubating), org.apache.pulsar:pulsar-docker-image (>=2.0.0-rc1-incubating, <=2.7.4) +1 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-proxy (>=2.0.0-rc1-incubating, <=2.7.4)

org.apache.pulsar:pulsar-proxy MAVEN version =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.1.0-incubating, =2.7.4 Source cves: CVE-2022-33682 Source advisory: OSV:GHSA-JVF3-MFXV-JCQR...

org.apache.pulsar:distribution (>=2.0.0-rc1-incubating, <=2.0.1-incubating), org.apache.pulsar:pulsar-docker-image (>=2.0.0-rc1-incubating, <=2.7.4) +1 more potentially affected by CVE-2022-33682 via org.apache.pulsar:pulsar-proxy (>=2.0.0-rc1-incubating, <=2.7.4)

org.apache.pulsar:pulsar-proxy MAVEN version =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.0.0-rc1-incubating, =2.1.0-incubating, =2.7.4 Source cves: CVE-2022-33682 Source advisory: GHSA-JVF3-MFXV-JCQR...

OESA-2022-1936 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where supplementary groups are not set up properly. If an...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5, <=2.7.1.6), fr.jetoile.hadoop:hadoop-unit-pulsar (>=3.6, <=3.8) +7 more potentially affected by CVE-2022-33683 via org.apache.pulsar:pulsar-broker (>=1.19.0-incubating, <=2.7.4)

org.apache.pulsar:pulsar-broker MAVEN version =1.19.0-incubating, =2.7.1.5, =3.6, =3.6, =2.0.0-rc1-incubating, =1.19.0-incubating, =2.4.0, =2.0.0-rc1-incubating, =2.1.0-incubating, =1.19.0-incubating, =2.7.4 Source cves: CVE-2022-33683 Source advisory: MEND:CVE-2022-33683...

Feehi CMS 2.1.1 - Remote Code Execution (Authenticated) Vulnerability

Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution RCE Authenticated Exploit Author: yuyudhn Vendor Homepage: https://feehi.com/ Software Link: https://github.com/liufee/cms Version: 2.1.1 REQUIRED Tested on: Linux, Docker CVE : CVE-2022-34140 Proof of Concept: 1. Login using admin account at...

Feehi CMS 2.1.1 - Remote Code Execution (Authenticated)

Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution RCE Authenticated Date: 22-08-2022 Exploit Author: yuyudhn Vendor Homepage: https://feehi.com/ Software Link: https://github.com/liufee/cms Version: 2.1.1 REQUIRED Tested on: Linux, Docker CVE : CVE-2022-34140 Proof of Concept: 1. Login using...

Exploit for CVE-2022-37708

Docker Lightman Exploit Docker CVE-2022-37708. This exploit r...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-...

org.apache.inlong:dataproxy-dist (0.10.0-incubating), org.apache.inlong:dataproxy-docker (0.10.0-incubating) +4 more potentially affected by CVE-2022-40955 via org.apache.inlong:inlong-common (0.10.0-incubating)

org.apache.inlong:inlong-common MAVEN version 0.10.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.inlong:inlong-common and may be impacted: - org.apache.inlong:dataproxy-dist 0.10.0-incubating - org.apache.inlong:dataproxy-dock...

Virtuozzo Hybrid Infrastructure 5.2 Update 1 (5.2.1-57)

This update provides full support for Authorization Code Flow, as well as bug fixes and improvements. Vulnerability id: VSTOR-57337 It is impossible to set the disk role to "Unassigned" while joining a node to the cluster. Vulnerability id: VSTOR-57187 Unable to add an iSCSI target with multiple...

Scanvus – my open source Vulnerability Scanner for Linux hosts and Docker images

Hello everyone! This video was recorded for the VMconf 22 Vulnerability Management conference, vmconf.pw. I will be talking about my open source project Scanvus. This project is already a year old and I use it almost every day. Alternative video link for Russia: Scanvus Simple Credentialed...

GHSA-RC4R-WH2Q-Q6C4 Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use...