CVE-2021-37384

CVE-2021-37384 affects Furukawa ONU models with vulnerable web interface components (e.g., Furukawa 423-41W/AC before 1.1.4 and LD421-21W before 1.3.3). The root cause is a Remote Code Execution via the web interface that allows unauthenticated remote command execution. Impact is high (as indicat...

Pluck v4.7.18 - Remote Code Execution Exploit

Exploit Title: Pluck v4.7.18 - Remote Code Execution RCE Application: pluck Version: 4.7.18 Bugs: RCE Technology: PHP Vendor URL: https://github.com/pluck-cms/pluck Software Link: https://github.com/pluck-cms/pluck Date of found: 10-07-2023 Author: Mirabbas Ağalarov Tested on: Linux import reques...

Admidio v4.2.10 - Remote Code Execution Vulnerability

Exploit Title: Admidio v4.2.10 - Remote Code Execution RCE Application: Admidio Version: 4.2.10 Bugs: RCE Technology: PHP Vendor URL: https://www.admidio.org/ Software Link: https://www.admidio.org/download.php Date of found: 10.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical...

Pluck v4.7.18 - Remote Code Execution (RCE)

Exploit Title: Pluck v4.7.18 - Remote Code Execution RCE Application: pluck Version: 4.7.18 Bugs: RCE Technology: PHP Vendor URL: https://github.com/pluck-cms/pluck Software Link: https://github.com/pluck-cms/pluck Date of found: 10-07-2023 Author: Mirabbas Ağalarov Tested on: Linux import reques...

CVE-2023-36887

CVE-2023-36887 affects Microsoft Edge (Chromium-based). Talos details a memory corruption/type confusion vulnerability in the MSDCPDF Javascript implementation used to process Acrobat-based PDFs, exploitable via specially crafted PDF documents. Affected Edge versions include 112.0.1722.58 and 114...

Improper Input Validation

Apache Airflow Apache Hive Provider is vulnerable to Improper Input Validation vulnerability. The vulnerability is due to not validating/sanitising proxyuser option and allowing injection of a semicolon while connecting to Apche Hive using Hive CLI Connection. This can result in bypassing securit...

User Registration < 3.0.2.1 - Subscriber+ Arbitrary File Upload Leading to RCE

The plugin does not validate the file types, and uses a hardcoded encryption key during the profile picture upload process. Authenticated users with minimal permissions, such as a subscriber, can thus upload arbitrary files, potentially leading to remote code execution...

CVE-2022-45855 Apache Ambari: Allows authenticated metrics consumers to perform RCE

SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7...

CVE-2022-45855 Apache Ambari: Allows authenticated metrics consumers to perform RCE

SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7...

Frappe Framework 13.4.0 Remote Code Execution

Exploit Title: Frappe Framework ERPNext 13.4.0 - Remote Code Execution Authenticated Exploit Author: Sander Ferdinand Date: 2023-06-07 Version: 13.4.0 Vendor Homepage: http://erpnext.org Software Link: https://github.com/frappe/frappe/ Tested on: Ubuntu 22.04 CVE : none Silly sandbox escape. Frap...

Spring Cloud 3.2.2 Remote Command Execution

Exploit Title: Spring Cloud 3.2.2 - Remote Command Execution RCE Date: 07/07/2023 Exploit Author: GatoGamer1155, 0bfxgh0st Vendor Homepage: https://spring.io/projects/spring-cloud-function/ Description: Exploit to execute commands exploiting CVE-2022-22963 Software Link:...

Patch Tuesday - July 2023

Microsoft is addressing 130 vulnerabilities this July Patch Tuesday, including five zero-day vulnerabilities, and eight further critical remote code execution RCE vulnerabilities. Overall, it’s safe to say that this is a busier Patch Tuesday than the past couple of months. Note that the total cou...

CVE-2023-35313

Windows Online Certificate Status Protocol OCSP SnapIn Remote Code Execution Vulnerability...

CVE-2023-33160

Microsoft SharePoint Server Remote Code Execution Vulnerability...

CVE-2023-35302

CVE-2023-35302 corresponds to a Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution vulnerability. The NVD entry specifies a CVSS v3.1 base score of 8.8 (Network attack vector, Low attack complexity, Privileges Required: Low, User Interaction: None, Scope: Unchanged) with hig...

CVE-2023-35344 Windows DNS Server Remote Code Execution Vulnerability

...

CVE-2023-35315

CVE-2023-35315 corresponds to the Windows Layer-2 Bridge Network Driver remote code execution vulnerability. According to the connected AVUL document, an unauthenticated attacker must be on a network segment with a Windows Server acting as a Layer-2 Bridge and send specially crafted file operatio...

CVE-2023-37656

WebsiteGuide v0.2 is vulnerable to Remote Command Execution RCE via image upload...

Remote Code Execution (RCE)

orthanc is vulnerable to Remote Code Execution RCE. The vulnerability allows users with authenticated access to overwrite arbitrary files allowing malicious attackers to overwrite the configurations resulting in rce...

CVE-2023-37659

CVE-2023-37659 affects xalpha v0.11.4. A remote command execution vulnerability arises from insufficient input validation when user-supplied data is evaluated, enabling network-based exploitation with high impact (CVSS v3.1: 9.8, HIGH confidentiality/integrity/availability). Multiple sources (GHS...