12021 matches found
Textpattern 4.8.3 - Remote code execution (Authenticated) (2)
Exploit Title: Textpattern 4.8.3 - Remote code execution Authenticated 2 Exploit Author: Ricardo Ruiz @ricardojoserf Vendor Homepage: https://textpattern.com/ Software Link: https://textpattern.com/start Version: Previous to 4.8.3 Tested on: CentOS, textpattern 4.5.7 and 4.6.0 Install dependencie...
Textpattern 4.8.3 - Remote code execution (Authenticated) (2)
Exploit Title: Textpattern 4.8.3 - Remote code execution Authenticated 2 Date: 03/03/2021 Exploit Author: Ricardo Ruiz @ricardojoserf Vendor Homepage: https://textpattern.com/ Software Link: https://textpattern.com/start Version: Previous to 4.8.3 Tested on: CentOS, textpattern 4.5.7 and 4.6.0...
RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...
Mail.ru: Reflected XSS on https://deti.mail.ru
Reflected XSS on deti.mail.ru via request header Referer...
Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure
Low-level users, such as subscribers, were able to trigger the action, wpajaxnfoauth, and retrieve the connection url needed to establish a connection. They could also retrieve the clientid for an already established OAuth connection. PoC Usage: php poc.php subscriber password $wpuser, 'pwd' =...
curl: CVE-2021-22876: Automatic referer leaks credentials
Summary: When using the --referer ';auto' feature the current URL is copied as-is to the referrer header of the subsequent request. The recommendation 1 is to strip these along with the URL fragment. I can imagine this may, in rare cases, result in unwanted/unexpected disclosure of credentials e....
CVE-2021-22881
CVE-2021-22881 concerns the Host Authorization middleware in Rails Action Pack, where specially crafted Host headers in combination with certain allowed-host formats (notably leading dots) can trigger an open redirect. Multiple connected sources confirm this is an Action Pack issue affecting Rail...
Node.JS Remote Code Execution
Exploit Title: Node.JS - 'node-serialize' Remote Code Execution 2 Exploit Author: UndeadLarva Software Link: https://www.npmjs.com/package/node-serialize Version: 0.0.4 CVE: CVE-2017-5941 import requests import re import base64 import sys url = 'http://192.168.100.133:8000/' change this payload =...
ASB-A-172349003
Bulletin has no description...
About the security content of macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave
About the security content of macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave This document describes the security content of macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. About Apple security updates For our...
Umbraco CMS 7.12.4 - Remote Code Execution (Authenticated)
Exploit Title: Umbraco CMS 7.12.4 - Remote Code Execution Authenticated Date: 2020-03-28 Exploit Author: Alexandre ZANNI noraj Based on: https://www.exploit-db.com/exploits/46153 Vendor Homepage: http://www.umbraco.com/ Software Link: https://our.umbraco.com/download/releases Version: 7.12.4...
Metasploit Framework 6.0.11 - msfvenom APK template command injection Exploit
Exploit Title: Metasploit Framework 6.0.11 - msfvenom APK template command injection Exploit Author: Justin Steven Vendor Homepage: https://www.metasploit.com/ Software Link: https://www.metasploit.com/ Version: Metasploit Framework 6.0.11 and Metasploit Pro 4.18.0 CVE : CVE-2020-7384 !/usr/bin/e...
