SolarWinds Orion Arbitrary File Write (CVE-2020-27871)

An arbitrary file write vulnerability exists in SolarWinds Network Configuration Manager. The vulnerability is due to insufficient validation of file types for vulnerability announcement data files in VulnerabilitySettings.aspx, combined with a lack of restriction on destination paths. A remote,...

Privilege escalation

An arbitrary file upload vulnerability exists in albumimages.jsp in Quicklert for Digium 10.0.0 1043 via a .mp3;.jsp filename for a file that begins with audio data bytes. It allows an authenticated low privileged attacker to execute remote code on the target server within the context of...

Apache Log4j2 suffers from a remote code execution vulnerability

Apache Log4j is a Java-based logging component . Apache Log4j2 is an upgraded version of Log4j , through the rewrite of Log4j introduced a rich feature set . The logging component is widely used in business systems development , to record program input and output log information. Apache Log4j2...

Cross-site Scripting (XSS) - Stored in poowf/invoiceneko

✍️ Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Then, the vulnerability can be triggered when the user previews the document´s content...

Pystinger - Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger implements SOCK4 proxy and port mapping through webshell. It can be directly used by metasploit-framework, viper, cobalt strike for session online. Pystinger is developed in python, and currently supports three proxy scripts: php, jspx and aspx. Usage Suppose the domain name of the serv...

Remote Command Execution Vulnerability in E-Mail Email System

YZP is a professional mail system software and total solution provider. The remote command execution vulnerability in the YZP email system can be exploited by an attacker to achieve remote command execution without authorization and gain access to the target server...

Unspecified Vulnerability in ONLYOFFICE Document Server

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. A security vulnerability exists in the ONLYOFFICE DocumentServer core module, which can be exploited by an attacker to shut down the target server...

Nessus Scanners Scanning Attempt

Nessus is a vulnerability scanning product. Remote attackers can use Nessus to detect vulnerabilities on a target server...

Microsoft Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. A remote code execution vulnerability exists in Microsoft Visual Studio. An attacker could exploit t...

Microsoft Visual Studio Code Execution Vulnerability

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a fundamentally complete set of development tools that includes most of the tools needed throughout the software lifecycle.Git for Visual Studio is one of the Git Distributed Version Control Git for Visual Studio i...

Microsoft Visual Studio 代码注入漏洞

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a fundamentally complete set of development tools that includes most of the tools needed throughout the software lifecycle.Git for Visual Studio is one of the Git Distributed Version Control Git for Visual Studio i...

JBoss JexBoss Security Scanner

JexBoss is a vulnerability scanning product. Remote attackers can use JexBoss to detect vulnerabilities on a target server...

Cisco UCS Director RestAPI Remote Code Execution (CVE-2020-3247)

A remote code execution vulnerability exists in Cisco UCS Directory. The vulnerability is due to insufficient validation of user input within ApplianceFileUploadEntryFormPage class' CopyFileRunnable run method. A remote authenticated attacker can exploit the vulnerability by sending malicious...

CVE-2020-11431

The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitrary system files and directories on the target server via Directory Traversal...

Arbitrary File Download Vulnerability in Visualized Smart Campus

Visualized smart campus is based on the physical environment of the campus, taking the real campus as a whole as a blueprint, using network technology, completing the construction of the visualization of the campus geographic information system, realizing the campus multi-dimensional virtual...

HPE Intelligent Management Center Remote Code Execution (CVE-2019-5387)

A remote code execution vulnerability exists in HPE Intelligent Management Center. A remote attacker can exploit this vulnerability by sending a crafted request to the target server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the...

HPE ByteMessageResource Insecure Deserialization (CVE-2019-11956)

An insecure deserialization vulnerability exists in HPE Intelligent Management Center. Successful exploitation of this vulnerability could result in execution of arbitrary code on the target server in the context of SYSTEM...

Belkin Wemo UPnP Remote Code Execution

A remote code execution vulnerability is exists in Belkin Wemo UPnP. A remote attacker can exploit this issue by sending a specially crafted packet to the target server. Successful exploitation could result in execution of arbitrary code on the affected system...

Xiamen Service Cloud Information Technology Co., Ltd. security dog suffers from webshell bypass vulnerability

Security Dog is a comprehensive server security protection tool that integrates server security protection and security management. Xiamen Service Cloud Information Technology Co., Ltd. security dog there is a webshell bypass vulnerability, attackers can use the vulnerability to obtain the target...

Telerik UI - Remote Code Execution via Insecure Deserialization Exploit

Exploit for asp platform in category web applications Telerik UI - Remote Code Execution via Insecure Deserialization Exploit See the full write-up at Bishop Fox, CVE-2019-18935: https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui, for a complete walkthrough of...