NuCom 11N Wireless Router 5.07.90 - Remote Privilege Escalation

Exploit Title: NuCom 11N Wireless Router 5.07.90 - Remote Privilege Escalation Date: 01.03.2021 Exploit Author: LiquidWorm Vendor Homepage: https://www.nucom.es Vendor: NUEVAS COMUNICACIONES IBERIA, S.A. Product web page: https://www.nucom.es Affected version: 5.07.90multiNCM01 5.07.89multiNCM01...

CVE-2020-23722

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuelid" parameters...

FUEL CMS 安全漏洞

FUEL CMS is a content management system based on CodeIgniter. An elevation of privilege vulnerability exists in FUEL CMS 1.4.7. The vulnerability can be exploited to gain super administrator privileges via the "id" and "fuelid" parameters...

WordPress Super Store Finder premium plugin <= 6.3 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by Eagle Eye in WordPress Super Store Finder premium plugin versions = 6.3. Solution Plugin vendor claims that vulnerability is patched in version 6.4...

CVE-2021-27228

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...

Design/Logic Flaw

An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefore an attacker can use JS Proto Method names such as constructor or hasOwnProperty to convince the System that the supplied API Key exists...

Gambling, Social Media, and 10 Years of Streaming the 'Big Game'

Thanks to the unique perspectives we have via the Akamai Intelligent Edge Platform, we're able to observe massive amounts of web traffic and data that provide insights across the various industries Akamai serves. In the wake of Super Bowl LV, we're sharing some observations on gambling traffic an...

Gambling, Social Media, and 10 Years of Streaming the 'Big Game'

Thanks to the unique perspectives we have via the Akamai Intelligent Edge Platform, we're able to observe massive amounts of web traffic and data that provide insights across the various industries Akamai serves. In the wake of Super Bowl LV, we're sharing some observations on gambling traffic an...

Hacker Tries to Poison Water Supply of Florida Town

A threat actor hacked into the computer system of the water treatment facility in Oldsmar, Fla., and tried to poison the town’s water supply by raising the levels of sodium hydroxide, or lye, in the water supply. The attack happened just two days before NFL’s Super Bowl LV was held nearby in Tamp...

WordPress Super Forms premium plugin <= 4.9.700 - Arbitrary File Upload leading to Remote Code Execution (RCE) vulnerability

Arbitrary File Upload leading to Remote Code Execution RCE vulnerability found by ABDO10 in WordPress Super Forms premium plugin versions = 4.9.700. Solution Update the WordPress Super Forms premium plugin to the latest available version at least 4.9.703...

Super Forms < 4.9.703 - Unauthenticated PHP File Upload to RCE

The plugin uses the jQuery File Upload library, but does not properly ensure that PHP files are forbidden. Note: Exploitation of the issue is not as easy as the original advisory in the references states. PoC If a form from the plugin with an upload field is present on the blog, and is used to...

Super Forms < 4.9.703 - Unauthenticated PHP File Upload to RCE

The plugin uses the jQuery File Upload library, but does not properly ensure that PHP files are forbidden. Note: Exploitation of the issue is not as easy as the original advisory in the references states. If a form from the plugin with an upload field is present on the blog, and is used to upload...

WordPress Super Forms Bundle premium plugin <= 4.9.700 - Arbitrary File Upload leading to Remote Code Execution (RCE) vulnerability

Arbitrary File Upload leading to Remote Code Execution RCE vulnerability found by ABDO10 in WordPress Super Forms Bundle premium plugin versions = 4.9.700. Solution Update the WordPress Super Forms Bundle premium plugin to the latest available version at least 4.9.703...

SmartAgent Security Vulnerabilities

A security vulnerability exists in SmartAgent 3.1.0 that can be exploited by an attacker to create Super Administrators via //CampaignManager/users...

File upload vulnerability exists in super cms (CNVD-2021-03275)

Super CMS is a content management system. A file upload vulnerability exists in super cms, which can be exploited by attackers to gain control of the server...

CVE-2018-16795

OpenEMR 5.0.1.3 allows Cross-Site Request Forgery CSRF via library/ajax and interface/super, as demonstrated by use of interface/super/managesitefiles.php to upload a .php file...

OpenEMR 跨站请求伪造漏洞

OpenEMR is an open source medical management system from the OpenEMR Openemr community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site request forgery vulnerability exists in OpenEMR version...

Linux: Read /etc/inetd.* and /etc/xinetd.* files

xinetd performs the same function as inetd: it starts programs that provide Internet services. Instead of having such servers started at system initialization time, and be dormant until a connection request arrives, xinetd is the only daemon process started and it listens on all service ports for...

kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c

A flaw was found in the Linux kernel's ext4unlink function. An attacker could corrupt memory or escalate privileges when deleting a file from a recently unmounted specially crafted ext4 filesystem, including local, USB, and iSCSI...

Privilege Escalation

Super is vulnerable to privilege escalation. The vulnerability existed because it does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors...