Android Security Bulletin—March 2023Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2023-03-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

CVE-2023-26949: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file...

Atlassian Confluence 7.12.x < 7.12.5 RCE Via OGNL Injection

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.23, 6.14.x prior to 7.4.11, 7.5.x prior to 7.11.6 or 7.12.x prior to 7.12.5. It is, therefore, affected by an OGNL injection vulnerability that would allow an attacker...

CVE-2023-24776

Funadmin v3.2.0 is affected by a remote code execution (RCE) vulnerability in the controllerAddon.php component (via \controller\Addon.php). NVD lists CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no privileges, no user interaction required, and impact to confidentiality, integr...

CVE-2023-24736: Undefined Security Weakness

PMB v7.4.6 was discovered to contain a remote code execution RCE vulnerability via the component /sauvegarde/restaureact.php...

Exploit for OS Command Injection in Netgate Pfblockerng

CVE-2022-31814 WebApp bug import argparse import requ...

Exploit for CVE-2021-3129

Laravel Debug Mode RCE Vulnerability CVE-2021-3129 POC / EXP...

CVE-2023-26779

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution RCE...

CVE-2023-26779

CVE-2023-26779 affects CleverStupidDog yf-exam v1.8.0. The vulnerability is described as a Deserialization flaw that can lead to Remote Code Execution (RCE). CVSS 3.1 base score 9.8 (CRITICAL) with NETWORK attack vector, low attack complexity, no privileges or user interaction required, and impac...

CVE-2023-26779

CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution RCE...

IBM WebSphere Application Server 7.x <= 7.0.0.45 / 8.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.22 / 9.x < 9.0.5.12 RCE

The IBM WebSphere Application Server installed on the remote host is affected by a remote code execution vulnerability due to the Dojo package, which is vulnerable to vulnerable to Prototype Pollution via the setObject function. Note that Nessus has not tested for this issue but has instead relie...

CentOS: Security Advisory for emacs-git (CESA-2023:0978)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9

New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Exploit for Deserialization of Untrusted Data in Alibaba Fastjson

CVE-2022-25845-exploit Try exploiting this CVE by studying so...

emacs, git, gitk, gitweb, perl security update

CentOS Errata and Security Advisory CESA-2023:0978 An update for git is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Exploit for OS Command Injection in Netgate Pfblockerng

CVE-2022-31814 text Reworked and optimized exploit scrip...

Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'Oracle E-Business Suite EBS Unauthenticated Arbitrary File Upload', 'Description' = %q This module exploits an unauthenticated...

D-Link DIR-867 Rev. A <= v1.30B07 RCE Vulnerability

D-Link DIR-867 Rev. A devices are prone to a remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

D-Link Routers Unauthenticated RCE (CVE-2022-26258)

The remote D-Link router is affected by a remote code execution vulnerability. D-Link DIR-820L 1.05B03 was discovered to contain a remote command execution RCE vulnerability via the Device Name parameter in /lan.asp. Note that Nessus has not tested for this issue but has instead relied only on th...

D-Link Routers RCE (CVE-2019-16057)

D-Link DNS-320 through 2.05.B10 is affected by command injection in the loginmgr.cgi component, which can lead to remote arbitrary code execution. The port parameter in the script could be poisoned to execute arbitrary commands, opening the door to an RCE attack. If the vulnerability is exploited...