QNAP QuTScloud RCE Vulnerability (QSA-22-20)

QNAP QuTScloud is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-26636

CVE-2021-26636 affects MaxBoard. The connected documents indicate a stored XSS and SQL injection vulnerability in MaxBoard that could lead to remote code execution, information exposure, and privilege escalation. The primary sources describe the vulnerable component as MaxBoard and emphasize impa...

DriftingCloud exploits zero-day in Sophos firewall

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary The Chinese APT actor DriftingCloud exploits the RCE vulnerability in Sophos firewall to take over the entire network...

Malicious code in daas-rce-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccca5084381eb8a536311d0a1902bb5104cfa8529c361da89aeb855895062cbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2313 Malicious code in daas-rce-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccca5084381eb8a536311d0a1902bb5104cfa8529c361da89aeb855895062cbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rce-techroom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 154bf6e647aca4f9f153e6e029e4d17d4557e6a4e7c423fb11c88358118cd762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5607 Malicious code in rce-techroom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 154bf6e647aca4f9f153e6e029e4d17d4557e6a4e7c423fb11c88358118cd762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

phpIPAM 1.4.5 Remote Code Execution

Exploit Title: phpIPAM 1.4.5 - Remote Code Execution RCE Authenticated Date: 2022-04-10 Exploit Author: Guilherme '@behiNdyk1' Alves Vendor Homepage: https://phpipam.net/ Software Link: https://github.com/phpipam/phpipam/releases/tag/v1.4.5 Version: 1.4.5 Tested on: Linux Ubuntu 20.04.3 LTS...

MaianAffiliate Code Injection Vulnerability Vulnerability

MaianAffiliate is a free, simple but powerful php referral system written in PHP. a security vulnerability exists in MaianAffiliate v.1.0, which stems from the existence of a PHP code injection issue. An authenticated attacker can exploit this vulnerability to obtain RCE through the MaianAffiliat...

Pandora FMS 7.0NG.742 Remote Code Execution

Exploit Title: Pandora FMS v7.0NG.742 - Remote Code Execution RCE Authenticated Date: 05/20/2022 Exploit Author: UNICORD NicPWNs & Dev-Yeoj Vendor Homepage: https://pandorafms.com/ Software Link:...

Sourcegraph Gitserver 3.36.3 Remote Code Execution

Exploit Title: Sourcegraph Gitserver 3.36.3 - Remote Code Execution RCE Date: 2022-06-10 Exploit Author: Altelus Vendor Homepage: https://about.sourcegraph.com/ Version: 3.63.3 Tested on: Linux CVE : CVE-2022-23642 Docker Container: sourcegraph/server:3.36.3 Sourcegraph prior to 3.37.0 has a remo...

Apache Flume remote code execution vulnerability

Apache Flume is a distributed, reliable and available service from the Apache Foundation. A remote code execution vulnerability exists in Apache Flume, which stems from the configuration of a JMS source with a JNDI LDAP data source URI, and could be exploited by an attacker to cause a remote code...

CVE-2021-41421

A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel...

Code injection

A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel...

CVE-2021-41421

A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin panel...

CVE-2021-41421

CVE-2021-41421 involves a PHP code injection vulnerability in MaianAffiliate v1.0 that enables an authenticated attacker to achieve remote code execution through the MaianAffiliate admin panel. The vulnerability is consistently described across sources as an authenticated code injection path lead...

CVE-2022-31849

The CVE-2022-31849 issue affects MERCURY MIPC451-4, version 1.0.22 Build 220105 Rel.55642n. A remote code execution (RCE) vulnerability exists exploitable via a crafted POST request. Impacted components: the device firmware; underlying cause is not further specified in the provided documents. CVS...

CVE-2022-31625

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or...

Denial of service

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or...

CVE-2022-31625

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or...