130 matches found
Metasploit Weekly Wrap-Up 05/03/24
Dump secrets inline This week, our very own cdelafuente-r7 added a significant improvement to the well-known Windows Secrets Dump module to reduce the footprint when dumping SAM hashes, LSA secrets and cached credentials. The module is now directly reading the Windows Registry remotely without...
PT-2024-26505 · Kemp · Kemp Loadmaster
Name of the Vulnerable Software and Affected Versions: Kemp LoadMaster affected versions not specified Description: Unauthenticated attackers can perform actions using SSH private keys by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster grou...
Kemp LoadMaster Unauthenticated Command Injection Exploit
This Metasploit module exploits an unauthenticated command injection vulnerability in Progress Kemp LoadMaster in the authorization header after version 7.2.48.1. The following versions are patched: 7.2.59.2 GA, 7.2.54.8 LTSF, and 7.2.48.10 LTS. This module requires Metasploit:...
Kemp LoadMaster Unauthenticated Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Kemp LoadMaster Unauthenticated Command Injection', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in...
Progress Kemp Flowmon 11.x < 11.1.14, 12.x < 12.3.5 RCE (CVE-2024-2389)
The version of Progress Kemp Flowmon installed on the remote host is prior to 11.1.14 or 12.3.5. It is, therefore, affected by an unauthenticated command injection vulnerability as referenced in the CVE-2024-2389 advisory. - Unauthenticated, remote attackers can gain access to the web interface o...
Progress Kemp Flowmon Web Interface Detection
Binary data progresskempflowmondetect.nbin...
CVE-2024-2448: Authenticated Command Injection In Progress Kemp LoadMaster
The post CVE-2024-2448: Authenticated Command Injection In Progress Kemp LoadMaster appeared first on Rhino Security Labs...
Progress Kemp LoadMaster Command Injection (CVE-2024-1212)
Binary data progresskemploadmasterCVE-2024-1212.nbin...
PT-2024-3306 · Kemp Technologies · Loadmaster
Name of the Vulnerable Software and Affected Versions: LoadMaster affected versions not specified Description: A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster...
Kemp LoadMaster Cross-Site Request Forgery Vulnerability
Kemp LoadMaster is a highly secure application from Kemp. Kemp LoadMaster suffers from a cross-site request forgery vulnerability that originates from allowing an attacker to direct an authenticated LoadMaster administrator to a third-party site to perform HTTP transactions on behalf of the...
LoadMaster security vulnerability
Kemp LoadMaster is a highly secure application from Kemp. A security vulnerability exists in LoadMaster that originates from an operating system command injection that allows an attacker to inject commands into a UI component using shell commands...
Exploit for OS Command Injection in Progress Loadmaster
CVE-2024-1212 Command Injection Exploit for Kemp LoadMaster 🛡️...
CVE-2024-1212: Unauthenticated Command Injection In Progress Kemp LoadMaster
The post CVE-2024-1212: Unauthenticated Command Injection In Progress Kemp LoadMaster appeared first on Rhino Security Labs...
Kemp LoadMaster Local sudo privilege escalation
This module abuses a feature of the sudo command on Progress Kemp LoadMaster. Certain binary files are allowed to automatically elevate with the sudo command. This is based off of the file name. Some files have this permission are not write-protected from the default 'bal' user. As such, if the...
Kemp LoadMaster Unauthenticated Command Injection
This module exploits an unauthenticated command injection vulnerability in Progress Kemp LoadMaster in the authorization header after vversion 7.2.48.1. The following versions are patched: 7.2.59.2 GA, 7.2.54.8 LTSF and 7.2.48.10 LTS. Module Options msf use...
Vulnerability fixed in Progress Kemp LoadMaster
Progress Kemp has fixed a vulnerability in LoadMaster. The vulnerability allows a malicious party to use specially API calls to issue system commands without being authorized. being authorized to do so. For successful exploitation, the malicious party must have access to the management interface...
PT-2024-2428
Name of the Vulnerable Software and Affected Versions Progress Kemp LoadMaster affected versions not specified Description Unauthenticated remote attackers can access the system through the management interface to execute arbitrary system commands. This issue occurs because the software fails to...
Kemp LoadMaster Operating System Command Injection Vulnerability
Kemp LoadMaster is a highly secure application from Kemp. A security vulnerability exists in Kemp LoadMaster version 7.2.48.1 that originates from a vulnerability that allows an unauthenticated, remote attacker to access the system via the LoadMaster management interface to execute arbitrary syst...