16193 matches found
CVE-2021-34083
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...
Microsoft Windows Support Diagnostic Tool (MSDT) RCE Vulnerability (Follina)
This host is missing a workaround for a critical security flaw in the Microsoft Windows Support Diagnostic Tool MSDT dubbed SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
CVE-2021-34083: Improper Neutralization of Special Elements used in an OS Command
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...
Exploit for CVE-2022-30190
Follina Proof of Concept CVE-2022-30190 Quick and easy "pro...
Microsoft Releases Workaround Guidance for MSDT "Follina" Vulnerability
Microsoft has released workaround guidance to address a remote code execution RCE vulnerability—CVE-2022-30190, known as "Follina"—affecting the Microsoft Support Diagnostic Tool MSDT in Windows. A remote, unauthenticated attacker could exploit this vulnerability to take control of an affected...
WordPress User Meta Lite / Pro 2.4.3 Path Traversal Vulnerability
RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: User Meta Vendor URL: https://wordpress.org/plugins/user-meta Type: Relative Path Traversal CWE-23 Date found: 2022-02-28 Date published: 2022-05-24 CVSSv3 Score: 4.3...
Nginx Plus < R24 P1 1-Byte Memory Overwrite RCE
According to its self reported version, the installed version of Nginx Plus prior to R24 P1. It is, therefore, affected by a remote code execution vulnerability. A security issue in nginx resolver was identified, which might allow an unauthenticated remote attacker to cause 1-byte memory overwrit...
The Microsoft Windows Support Diagnostic Tool (MSDT) RCE Workaround Detection (CVE-2022-30190)
The remote host has the HKEYCLASSESROOT\ms-msdt registry key. This is a known exposure for CVE-2022-30190. Note that Nessus has not tested for CVE-2022-30190. It is only checking if the registry key exists. The recommendation is to apply the latest patch. C Tenable, Inc. include'compat.inc'; if...
Exploit for CVE-2022-30190
POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina...
WordPress User Meta Lite / Pro 2.4.3 Path Traversal
RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: User Meta Vendor URL: https://wordpress.org/plugins/user-meta Type: Relative Path Traversal CWE-23 Date found: 2022-02-28 Date published: 2022-05-24 CVSSv3 Score: 4.3...
KLA12550 RCE vulnerability in Microsoft Products (ESU)
A remote code execution vulnerability was found in Microsoft Products Extended Security Update. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-30190 Exploitation Public exploits exist for this vulnerability. Malware exists for this...
KLA12549 RCE vulnerability in Microsoft Windows
A remote code execution vulnerability was found in Microsoft Windows. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2022-30190 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware...
CVE-2022-25237
CVE-2022-25237 concerns Bonita Web 2021.2. An authentication/authorization bypass occurs due to an overly broad exclude pattern in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoint...
Experts Detail New RCE Vulnerability Affecting Google Chrome Dev Channel
Details have emerged about a recently patched critical remote code execution vulnerability in the V8 JavaScript and WebAssembly engine used in Google Chrome and Chromium-based browsers. The issue relates to a case of use-after-free in the instruction optimization component, successful exploitatio...
CVE-2022-30423
CVE-2022-30423 affects Merchandise Online Store v1.0 by oretnom23. The vulnerability is described as an arbitrary code execution (RCE) in the user profile upload point on the system information page. The available connected documents corroborate an RCE impact but do not provide technical details ...
CVE-2022-30423: Unrestricted Upload of File with Dangerous Type
Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution RCE vulnerability in the user profile upload point in the system information...
QNAP QuTS hero RCE Vulnerability (QSA-21-57)
QNAP QuTS hero is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
QNAP QuTScloud RCE Vulnerability (QSA-21-57)
QNAP QuTScloud is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Microsoft Patch Tuesday May 2022: Edge RCE, PetitPotam LSA Spoofing, bad patches
Hello everyone! This episode will be about Microsoft Patch Tuesday for May 2022. Sorry for the delay, this month has been quite intense. As usual, Im using my Vulristics project and going through not only the vulnerabilities that were presented on May 10th, but all the MS vulnerabilities presente...