14850 matches found
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
Ruckus Wireless Access Point AP software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery CSRF or remote code execution RCE. This vulnerability impacts Ruckus ZoneDirector,...
CVE-2022-47879
Summary: CVE-2022-47879 affects Jedox. A remote authenticated RCE exists in /be/rpc.php (and /be/erpc.php per exploit sources) where an attacker can load arbitrary PHP classes from the rtn directory and execute methods. Affected version: Jedox 2020.2.5 and earlier; vendor notes the issue affects ...
CVE-2023-31502
Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution RCE vulnerability via the component /models/managementmodel.php...
Privilege escalation (PR)/RCE from account through class sheet
Impact It's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. Steps to Reproduce: 1. Edit your user profile with the object editor and add an object of type DocumentSheetBinding with value Default Class Sheet 1. Edit your user profile with the...
Pentaho Business Server Authentication Bypass / SSTI / Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pentaho Business Server Auth Bypass and Server Side Template Injection RCE', 'Description' = %q Hitachi Vantara Pentaho Business Analytics Server...
CVE-2023-31502
Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution RCE vulnerability via the component /models/managementmodel.php...
ManageEngine ADManager Plus <= Build 7005 RCE (deprecated)
This plugin has been deprecated. Use manageengineadauditpluscve-2021-42847.nbin plugin ID 155716 instead. %NASLMINLEVEL 80900 C Tenable, Inc. @DEPRECATED@ Disabled on 2023/05/12. Deprecated by manageengineadauditpluscve-2021-42847.nbin include'compat.inc'; if description scriptid175389;...
CVE-2023-31502
CVE-2023-31502 affects Altenergy Power Control Software C1.2.5, where a remote code execution (RCE) vulnerability is exposed via the component /models/management_model.php. The root cause is not detailed in the provided documents beyond the RCE path, but CVSS v3.1 metrics indicate network access,...
CVE-2022-47129
PHPOK v6.3 is identified as affected by a remote code execution (RCE) vulnerability. The provided sources confirm an RCE impact but do not include concrete technical details about the root cause, vectors, or a verified fix. CVSS data from the initial entry indicates a high-severity, network-based...
n8n-nodes-accelo (>=0.1.0, <=0.1.9), n8n-nodes-closeio (0.1.0) +10 more potentially affected by CVE-2023-27564 via n8n (>=0.81.0, <=0.214.5)
n8n NPM version =0.81.0, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.2.14, =0.1.0, =0.1.0, =0.0.2, =0.0.2, =1.1.3 Source cves: CVE-2023-27564 Source advisory: OSV:GHSA-R9XW-P7WJ-W792...
Update now! May 2023 Patch Tuesday tackles three zero-days
Its that time of the month again: We're looking at May's Patch Tuesday roundup. Microsoft has released its monthly update, and while the total number of patched vulnerabilities is relatively low at 38, among them are three zero-day vulnerabilities. Microsoft classifies a vulnerability as a zero-d...
Microsoft Message Queuing RCE (CVE-2023-21554, QueueJumper)
Binary data msmq2023-04.nbin...
Security Updates for Microsoft SharePoint Server 2019 (May 2023)
The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A Sharepoint Server spoofing vulnerability. CVE-2023-24950 - A Sharepoint Server information disclosure vulnerability. CVE-2023-24950 - A...
Patch Tuesday - May 2023
A less crowded Patch Tuesday for May 2023: Microsoft is offering fixes for just 49 vulnerabilities this month. There are no fixes this month for printer drivers, DNS, or .NET, three components which have featured heavily in recent months. Three zero-day vulnerabilities are patched, alongside a...
Why Attackers Target the Government Industry
Key Takeaways: Government sites are full of information attackers want, so it’s crucial to defend them properly. DDoS is an easy tool for attackers to use to disrupt government sites, which can have far-reaching consequences, as we saw early in the Russia-Ukraine war. Remote code execution RCE...
Microsoft Windows AV1 Video Extensions RCE (May 2023)
The Windows 'AV1 Video Extension' app installed on the remote host is affected by remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. %NASLMINLEVEL 80900 C Tenable Network Security, Inc. The descriptive text and...
Exploit for CVE-2021-46703
CVE-2021-46703 Simple payload builder based on POC in: https:/...
Exploit for CVE-2022-21907
CVE-2022-21907-RCE...
