292899 matches found
...[ More ]
An unauthenticated attacker sends an email containing a crafted tar attachment through Cisco Secure Email Gateway. Inside the tar, a POSIX pax extended header applies linkpath=bin/corewatch.sh to a hard-link member. That member also contains the module's shell command launcher. AMP File Reputatio...
WordPress Import and Export Users and Customers 2.4.17 Privilege Escalation
WordPress Import and export users and customers plugin versions through 2.4.17 contain an authenticated privilege escalation issue. Crafted subscriber profile fields can be misparsed during an administrator-triggered export and re-import, assigning the attacker the administrator role...
Elo 1.0.0 Sandbox Escape
Elo version 1.0.0 and earlier contains a sandbox escape through unfiltered JavaScript meta-property access. The proof of concept differentially verifies constructor-chain code execution and its rejection in version 1.0.1. https://packetstorm.news/download/239633...
Adobe ColdFusion 2021 Update 5 / 2018 Update 15 Unauthenticated Remote Code Execution
Adobe ColdFusion versions 2021 Update 5 and earlier and 2018 Update 15 and earlier contain an improper access control vulnerability that can lead to arbitrary code execution. This proof of concept uses log poisoning and file inclusion to execute a supplied command...
PHP 8.4.26 OOM Remote Code Execution
PHP version 8.4.26 contains an out-of-memory request-parsing flaw that can leave request state uninitialized, enabling unauthenticated remote code execution in Apache modphp. This proof of concept includes OOM probing, ASLR leak, and RCE drivers. https://packetstorm.news/download/239626...
eMudhra/emSign Intermediate CA Certificate Forgery
eMudhra/emSign intermediate CA certificates with weak P-384 private scalars allow recovery of CA private keys and certificate forgery for clients retaining affected trust chains. https://packetstorm.news/download/239619...
WordPress Login & Register Forms 4.0.1 Email Disclosure
WordPress Login & Register Forms versions before 4.0.2 contain an unauthenticated email-address disclosure vulnerability in the password-reset flow when verification-code mode is enabled. https://packetstorm.news/download/239612...
PHP 8.5.11 Stale Global State Remote Code Execution
PHP version 8.4.16 contains a stale session upload-progress use-after-free that can enable remote code execution when a multipart request exhausts memory and a subsequent request reaches the same modphp worker. This proof of concept is restricted to a calibrated isolated Apache laboratory profile...
Hikvision Cameras and NVRs Authentication Bypass
Hikvision cameras and NVRs contain an authentication bypass vulnerability that allows remote attackers to download and decrypt configuration files, exposing administrator credentials, and access snapshots. https://packetstorm.news/download/239632...
Samsung One UI 8.5 HEIF Decoder Arbitrary Free
Samsung One UI version 8.5 contains an attacker-controlled free vulnerability in the libsimba HEIF decoder's item-property parsing. Included HEIC proof-of-concept files trigger an out-of-bounds property-table access when opened in Samsung Gallery. https://packetstorm.news/download/239638...
Samsung libsecwavextractor.so Android 16 Heap Buffer Overflow
Samsung libsecwavextractor.so on Android version 16 contains a heap buffer overflow in IMA-ADPCM WAV processing. The proof of concept WAV uses an oversized nBlockAlign value to exceed a fixed 32 KiB MediaBuffer allocation in media.extractor. https://packetstorm.news/download/239640...
Craft CMS 5.6.14 Authenticated Twig SSTI / Remote Code Execution
Craft CMS versions 4.x before 4.14.13 and 5.x before 5.6.15 contain an authenticated Twig server-side template injection vulnerability that can lead to remote code execution through Entry URI Format evaluation...
Boa 0.94.14rc21 Terminal Escape Sequence Log Injection
Boa version 0.94.14rc21 contains an error-log terminal escape sequence injection vulnerability. The proof of concept sends a percent-encoded HTTP request path containing terminal control characters...
Horizon DataSys Reboot Restore Standard 13.2 Local Privilege Escalation
Horizon DataSys Reboot Restore Standard version 13.2 and earlier contains a local privilege escalation vulnerability in shield.sys. This proof of concept uses its arbitrary kernel memory read/write condition to replace the current process token. https://packetstorm.news/download/239620...
Boa Webserver 0.94.14rc21 Signed-Character Heap Overflow
Boa Webserver version 0.94.14rc21 Debian builds contain a signed-character heap buffer overflow in the error-log pathname escaping routine. The proof of concept sends percent-encoded high-byte values in a request path to reach the affected logging path...
Rocket.Chat 3.12.1 NoSQL Injection / Code Execution
Rocket.Chat version 3.12.1 contains a NoSQL injection issue that can permit administrator account takeover and command execution. This proof of concept leaks reset data, resets an administrator password, and executes a supplied command through an incoming webhook...
WordPress Project Manager 4.1.1 Unauthenticated Remote Code Execution
WordPress Project Manager plugin versions through 4.1.1 contain an unauthenticated remote code execution vulnerability via the id parameter. The supplied proof of concept executes commands and can optionally upload a shell. https://packetstorm.news/download/239607...
Fastjson 1.2.24 @type Remote Code Execution
Fastjson version 1.2.24 contains an unsafe @type deserialization flaw that may permit remote code execution through JNDI on affected pre-8u191 Java runtimes. The included proof of concept demonstrates the issue. https://packetstorm.news/download/239613...
OnePlus Pad 3 Pro ColorOS 17.0.0.105 Local Privilege Escalation
OnePlus Pad 3 Pro ColorOS version 17.0.0.105 contains a posix CPU timer use-after-free. This proof of concept uses Shizuku to obtain root and load KernelSU. https://packetstorm.news/download/239606...
