Exploit for Path Traversal in Igniterealtime Openfire

CVE-2023-32315 Openfire Console Authentication Bypass Vulnerab...

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

CVE-2023-27997 Vulnerability Assessment Tool Safely detect wh...

CVE-2023-30625

Rudder-server (RudderStack CDP) prior to version 1.3.0-rc.1 is affected by an SQL injection that can lead to remote code execution because the postgres user rutde_rudder is granted superuser privileges by default. Affected component: rudder-server in RudderStack; vulnerability is triggered via SQ...

CVE-2023-30625 rudder-server vulnerable to SQL Injection

rudder-server is part of RudderStack, an open source Customer Data Platform CDP. Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution RCE due to the rudder role in PostgresSQL having superuser permissions by default. Version...

WinSCP < 5.17.10 RCE

The version of WinSCP installed on the remote Windows host is prior to 5.17.10. It is, therefore, affected by a remote code execution vulnerability that allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. For example, th...

Desktop APP XSS to RCE

🔒️ Requirements The user must load the malicious configuration and click on the buttons. 📝 Description This exploitation relies on several issues which chained together lead to an RCE. In the following subsection, I will try to explain it as best I can. 💉 Not sanitized HTML injection In the...

PyLoad 0.5.0 Remote Code Execution

Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE Date: 06-10-2023 Credits: bAu @bauh0lz Exploit Author: Gabriel Lima 0xGabe Vendor Homepage: https://pyload.net/ Software Link: https://github.com/pyload/pyload Version: 0.5.0 Tested on: Ubuntu 20.04.6 CVE: CVE-2023-0297 import...

CVE-2023-34252 Grav Server-side Template Injection via Insufficient Validation in filterFilter

Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the GravExtension.filterFilter function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a...

CVE-2023-34251

Grav (flat‑file CMS) versions before 1.7.42 are vulnerable to server‑side template injection (SSTI) that can enable remote code execution when a user with page editing privileges embeds malicious PHP on the administrator screen. The issue is mitigated by a fix in version 1.7.42. Public details in...

GHSA-6QMF-MMC7-6C2P NuGet Client Remote Code Execution Vulnerability

Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET and NuGet on Linux. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET 6.0, .NET 7.0...

Langchain OS Command Injection vulnerability

Langchain before v0.0.225 was discovered to contain a remote code execution RCE vulnerability in the component JiraAPIWrapper aka the JIRA API wrapper. This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available...

CVE-2023-29337

CVE-2023-29337 is a Linux-specific vulnerability in NuGet Client (and related .NET tooling) describing a race condition that can enable a symlink attack and remote code execution when a victim opens specially crafted content. IBM/IBM RPA advisory confirms remote code execution possibilities via ....

CVE-2023-28310 Microsoft Exchange Server Remote Code Execution Vulnerability

...

Exploit for Command Injection in Vmware Aria_Operations_For_Networks

CVE-2023-20887 Exploit VMWare vRealize Network Insight Pre-Aut...

Microsoft fixes six critical vulnerabilities in June Patch Tuesday

Its that time of the month again: We're looking at June's Patch Tuesday roundup. Microsoft has released its monthly update, and compared to previous months, its actually not so bad. No actively exploited zero-days and only six critical vulnerabilities. So, well have the luxury of going over those...

CVE-2023-32017

Microsoft PostScript Printer Driver Remote Code Execution Vulnerability...

Microsoft Outlook 2013 Service Pack 1 RCE Vulnerability (KB5002382)

This host is missing an important security update according to Microsoft KB5002382 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

CVE-2023-25367

CVE-2023-25367 affects Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS. The issue is unfiltered user input allowing Remote Code Execution via the SCPI interface or web server. Root cause: insufficient input validation and, in some sources, lack of authentication on the SCPI interface, enabling remot...

Remote Desktop Client for Windows RCE (June 2023)

The Windows Remote Desktop client for Windows installed on the remote host is missing security updates. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not...

CVE-2023-34540

Langchain before v0.0.225 was discovered to contain a remote code execution RCE vulnerability in the component JiraAPIWrapper aka the JIRA API wrapper. This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available...