Description of the security update for SharePoint Foundation 2013: January 11, 2022 (KB5002127)

Description of the security update for SharePoint Foundation 2013: January 11, 2022 KB5002127 Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability and Microsoft Office remote code execution vulnerability. To learn more about the vulnerabilities,...

Description of the security update for SharePoint Enterprise Server 2016: January 11, 2022 (KB5002113)

Description of the security update for SharePoint Enterprise Server 2016: January 11, 2022 KB5002113 Applies To SharePoint Server 2016 Summary This security update resolves a Microsoft Word remote code execution vulnerability, Microsoft Office remote code execution vulnerability, and Microsoft...

Description of the security update for SharePoint Server Subscription Edition: January 11, 2022 (KB5002111)

Description of the security update for SharePoint Server Subscription Edition: January 11, 2022 KB5002111 Applies To SharePoint Server Subscription Edition Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability and Microsoft Office remote code...

When access the storefront webpage getting .Net errors

When access the newly added Storefront server getting the below error. Error : The 'targetFramework' attribute in the element of the Web.config file is used only to target version 4.0 and later of the .NET Framework for example, ''. The 'targetFramework' attribute currently references a version...

CVE-2021-39392

The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded the same for all customers' installations in web.config, and can be used to send serialized ASP code...

Hardcoded credentials

The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded the same for all customers' installations in web.config, and can be used to send serialized ASP code...

CVE-2021-39392

The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded the same for all customers' installations in web.config, and can be used to send serialized ASP code...

CVE-2021-39392

The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded the same for all customers' installations in web.config, and can be used to send serialized ASP code...

CVE-2021-39392

CVE-2021-39392 affects MyLittleBackup (up to and including 1.7). The issue is a hardcoded machineKey in web.config, shared across installations, enabling remote attackers to send serialized ASP code and achieve arbitrary code execution. The vulnerability is described as a remote, network-based ri...

PT-2021-22577

Name of the Vulnerable Software and Affected Versions: MyLittleBackup versions up to and including 1.7 Description: The management tool in MyLittleBackup allows remote attackers to execute arbitrary code because the machineKey is hardcoded in web.config, and can be used to send serialized ASP cod...

CVE-2021-37334

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a...

CVE-2021-37334

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a...

Arbitrary file deletion

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a...

CVE-2021-37334

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a...

CVE-2021-37334

Umbraco Forms versions 4.0.0 through 8.7.5 (and older) are vulnerable to remote code execution and arbitrary file deletion due to file-extension validation occurring after files are stored in a temporary directory (%BASEDIR%/APP_DATA/TEMP/FileUploads/). The web.config protections restricting this...

CVE-2021-37334: Undefined Security Weakness

Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack and/or arbitrary file deletion. A vulnerability occurs because validation of the file extension is performed after the file has been stored in a...

PT-2021-21611

Name of the Vulnerable Software and Affected Versions Umbraco Forms versions 4.0.0 through 8.7.5 Description A security flaw in Umbraco Forms could lead to a remote code execution attack and/or arbitrary file deletion. The issue arises because validation of the file extension is performed after t...

Description of the security update for Office Online Server: June 8, 2021 (KB5001943)

Description of the security update for Office Online Server: June 8, 2021 KB5001943 Applies To DONOTUSEOffice Online Server Summary This security update resolves a Microsoft Excel remote code execution vulnerability. To learn more, see Microsoft Common Vulnerabilities and Exposures CVE-2021-31939...

Microsoft SharePoint SSI / ViewState Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SharePoint Server-Side Include and ViewState RCE', 'Description' = %q This module exploits a server-side include SSI in SharePoint to...

Microsoft SharePoint SSI / ViewState Remote Code Execution Exploit

This Metasploit module exploits a server-side include SSI in SharePoint to leak the web.config file and forge a malicious ViewState with the extracted validation key. This exploit is authenticated and requires a user with page creation privileges, which is a standard permission in SharePoint. The...