PT-2021-4992 · Mcafee · Mcafee Total Protection

Name of the Vulnerable Software and Affected Versions: McAfee Total Protection versions prior to 16.0.30 Description: The issue is related to improper privilege management, allowing a local user to gain elevated privileges and execute arbitrary code, bypassing self-defense mechanisms. This can be...

Reentrancy Attack

openzeppelin-solidity is vulnerable to reentrancy attack. The vulnerability exists when a extend custom beforeTokenTransfer is invoked when burning tokens and before the send hook is externally called on the sender while token balances are adjusted after the process and this may cause the...

The vulnerability of the Kaspersky Total Security antivirus protection, related to code errors, allows attackers to increase their privileges.

The vulnerability of the Kaspersky Total Security antivirus protection is related to errors in the code. Exploiting this vulnerability can allow attackers to enhance their privileges by manipulating symbolic links...

The vulnerability of the Kaspersky Total Security antivirus protection, related to errors in multi-threaded operations, allows attackers to increase their privileges.

The vulnerability of the Kaspersky Total Security antivirus protection is related to errors in multi-threaded operations. Exploiting this vulnerability can allow attackers to increase their privileges...

WordPress Total Upkeep Unauthenticated Backup Downloader

This module exploits an unauthenticated database backup vulnerability in WordPress plugin 'Boldgrid-Backup' also known as 'Total Upkeep' version use auxiliary/scanner/http/wptotalupkeepdownloader msf auxiliarywptotalupkeepdownloader show actions ...actions... msf auxiliarywptotalupkeepdownloader...

Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat

This post was authored by Hossein Jazi On December 7 2020 we identified a malicious document uploaded to Virus Total which was purporting to be a meeting request likely used to target the government of South Korea. The meeting date mentioned in the document was 23 Jan 2020, which aligns with the...

CVE-2020-36848

creationtimestamp| type| source ---|---|--- 2021-01-05 20:10:05+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wptotalupkeepdownloader.rb 2025-10-23 21:12:59+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7...

WordPress W3 Total Cache 0.9.3 File Read / Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress W3 Total Cache File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability i...

WordPress Plugin W3 Total Cache - Unauthenticated Arbitrary File Read (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress W3 Total Cache File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability i...

WordPress Total Upkeep plugin <= 1.14.9 - Unauthenticated Backup Archive Download vulnerability

Unauthenticated Backup Archive Download vulnerability found by Wadeek in WordPress Total Upkeep plugin versions = 1.14.9. Solution Update the WordPress Total Upkeep plugin to the latest available version at least 1.14.10...

WordPress Total Upkeep plugin <= 1.14.9 - Sensitive Information Disclosure vulnerability

Sensitive Data Disclosure Server IP Address, UID etc vulnerability found by Wadeek in WordPress Total Upkeep plugin versions = 1.14.9. Solution Update the WordPress Total Upkeep plugin to the latest available version at least 1.14.10...

Total Upkeep by BoldGrid < 1.14.10 - Unauthenticated Backup Download

The plugin does not restrict access to a file containing sensitive information, such as the internal path of backups, which may then allow unauthenticated users to download them. PoC The filepath in /wp-content/plugins/boldgrid-backup/cron/restore-info.json will reveal the internal path of the...

WordPress Total Upkeep 1.14.9 Backup Disclosure

Exploit Title: WordPress Plugin Total Upkeep 1.14.9 - Database and Files Backup Download Google Dork: intitle:"Index of" AND "wp-content/plugins/boldgrid-backup/=" Date: 2020-12-12 Exploit Author: Wadeek Vendor Homepage: https://www.boldgrid.com/ Software Link:...

Total Upkeep by BoldGrid < 1.14.10 - Unauthenticated Backup Download

The plugin does not restrict access to a file containing sensitive information, such as the internal path of backups, which may then allow unauthenticated users to download them. The filepath in /wp-content/plugins/boldgrid-backup/cron/restore-info.json will reveal the internal path of the backup...

WordPress Plugin Total Upkeep 1.14.9 - Database and Files Backup Download

Exploit Title: WordPress Plugin Total Upkeep 1.14.9 - Database and Files Backup Download Google Dork: intitle:"Index of" AND "wp-content/plugins/boldgrid-backup/=" Date: 2020-12-12 Exploit Author: Wadeek Vendor Homepage: https://www.boldgrid.com/ Software Link:...

Contiki Buffer Error Vulnerability

Contiki is an open source cross-platform operating system for IoT Internet of Things devices. Contiki 3.0 suffers from a buffer error vulnerability that stems from an inability to validate the total length of incoming packets specified in its IP header as well as the segmentation offset value...

Congrats to the winners of the 2020 December Metasploit community CTF

Thank you all that participated in the 2020 December Metasploit community CTF! The four day CTF was well received by the community, with 874 teams and 1903 users registered! We’ve included the high-level stats and the competition winners below. If you played the CTF and want to let the Metasploit...

McAfee Total Protection Elevation of Privilege Vulnerability

McAfee Total Protection is a one-stop security suite. An elevation of privilege vulnerability exists in McAfee Total Protection versions prior to 16.0.29. An attacker can exploit the elevation of privilege vulnerability by creating a junction link to manipulate a folder...

CVE-2020-28573

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal the total agents managed by the server...

CVE-2020-7335

Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection MTP prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only...