51042 matches found
Emsisoft Anti-Malware Net-NTLMv2 Hash Information Disclosure
A vulnerability affecting the scanning module in Emsisoft Anti-Malware versions prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash information via a specially created A2S Emsisoft Custom Scan extension file. Title: Emsisoft Anti-Malware 2024.12 - ".A2S" Net-NTLMv2 Hash...
Ivanti Buffer Overflow Proof of Concept
Proof of concept exploit for CVE-2025-0282, a remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways. PoC for CVE-2025-0282, a remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure,...
ABB AC500v3 3.7.0.569 Directory Traversal / Privilege Escalation
ABB AC500v3 versions 3.7.0.569 and below suffer from privilege escalation and directory traversal vulnerabilities. CyberDanube Security Research 20250107-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities in ABB AC500v3 product| ABB...
OBS 1.0 Shell Upload
OBS version 1.0 suffers from a remote shell upload vulnerability. Titles: OBS by: oretnom23 v1.0 -Copyright © 2025. All rights reserved. File Upload-FU and Remote Code Execution-RCE Vulnerabilities Author: nu11secur1ty Date: 01/16/2025 Vendor: https://github.com/oretnom23 Software:...
Bruno IDE Desktop Command Injection
A command injection vulnerability in the function shell.openExternal of Bruno IDE Desktop prior to version 1.29.0 allows attackers to execute arbitrary commands by supplying a crafted URL, leading to potential remote code execution. ===== Tempest Security Intelligence - ADV-10/2024...
Cleo LexiCom / VLTrader / Harmony 5.8.0.23 Remote Code Execution
This Metasploit module exploits an unauthenticated file write vulnerability in Cleo LexiCom, VLTrader, and Harmony versions 5.8.0.23 and below. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...
OCLS MSMS-PHP 1.0 Shell Upload
OCLS MSMS-PHP version 1.0 suffers from a remote shell upload vulnerability. Titles: OCLS MSMS-PHP by: oretnom23 v1.0 -Copyright © 2025. All rights reserved. File Upload-FU and Remote Code Execution-RCE Vulnerabilities Author: nu11secur1ty Date: 01/15/2025 Vendor: https://github.com/oretnom23...
WordPress ARPrice 4.0.3 PHP Object Injection
WordPress ARPrice plugin versions 4.0.3 and below suffer from an authenticated PHP object injection vulnerability. CVE-2024-49699 ARPrice = 4.0.3 - Authenticated Subscriber+ PHP Object Injection Description The ARPrice plugin for WordPress is vulnerable to PHP Object Injection in versions up to,...
WordPress Event Monster 1.4.3 Information Disclosure
WordPress Event Monster plugin versions 1.4.3 and below suffer from an information disclosure vulnerability. CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress ...
WordPress SuperBackup 2.3.3 Missing Authorization
WordPress SuperBackup plugin versions 2.3.3 and below suffer from a backup disclosure due to a missing authorization vulnerability. CVE-2024-56067 WP SuperBackup = 2.3.3 - Missing Authorization to Unauthenticated Back-Up File Download Description The Super Backup & Clone - Migrate for WordPress...
WordPress linkID 0.1.2 Missing Authorization / Information Disclosure
WordPress linkID plugin versions 0.1.2 and below suffers from a missing authorization vulnerability that results in information disclosure. CVE-2024-12542 linkID = 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure Description The linkID plugin for WordPress is...
Microweber 2.0.9 Cross Site Scripting
Microweber versions 2.0.9 and below suffer from multiple persistent cross site scripting vulnerabilities. CVE-2024-33298 Stored Cross Site Scripting vulnerability in Microweber .jpg on /media/default/ 6. Go back to the endpoint /admin/module/view?type=adminbackup and click on "Upload file" 7...
WordPress Fancy Product Designer 6.4.3 SQL Injection
WordPress Fancy Product Designer plugin versions 6.4.3 and below suffers from an unauthenticated remote SQL injection vulnerability. CVE-2024-51818 Fancy Product Designer = 6.4.3 - Unauthenticated SQL Injection Description The Fancy Product Designer plugin for WordPress is vulnerable to SQL...
WordPress Partners 0.2.0 PHP Object Injection
WordPress Partners plugin versions 0.2.0 and below suffer from a deserialization vulnerability. CVE-2024-56059 Partners = 0.2.0 - Unauthenticated PHP Object Injection Description The Partners plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 0.2.0 via...
WordPress CF Internal Link Shortcode 1.1.0 SQL Injection
WordPress CF Internal Link Shortcode plugin versions 1.1.0 and below suffer from a remote SQL injection vulnerability. CVE-2024-12404 CF Internal Link Shortcode = 1.1.0 - Unauthenticated SQL Injection Description The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection v...
WordPress Chartify 2.9.5 Local File Inclusion
WordPress Chartify plugin versions 2.9.5 and below suffers from a local file inclusion vulnerability. CVE-2024-10571 Chartify – WordPress Chart Plugin = 2.9.5 - Unauthenticated Local File Inclusion via source Description The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to...
WordPress VRPConnector 2.0.1 PHP Object Injection
WordPress VRPConnector plugin versions 2.0.1 and below suffer from an unauthenticated PHP object injection vulnerability. CVE-2024-56058 VRPConnector = 2.0.1 - Unauthenticated PHP Object Injection Description The VRPConnector plugin for WordPress is vulnerable to PHP Object Injection in versions ...
WordPress SuperBackup 2.3.3 Shell Upload
WordPress SuperBackup plugin versions 2.3.3 and below suffer from a remote shell upload vulnerability. CVE-2024-56064 WP SuperBackup = 2.3.3 - Unauthenticated Arbitrary File Upload Description The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file...
Netsweeper Privilege Escalation
Netsweeper allows for unauthorized changes to the account owner field due to a lack of server-side controls. Patched in NS1271GA. Description: Netsweeper's account management interface allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and a lack of...
Linux inotify_rm_watch() Race Condition / Use-After-Free
Linux suffers from a race condition in inotifyrmwatch with umount that can lead to a superblock-related use-after-fre condition. Summary There's a UAF race between inotifyrmwatch and umount; my guess is that it is hard to hit at least when paniconoops is enabled because a more likely race orderin...
WebKit DocumentFontLoader::fontLoadingTimerFired Use-After-Free
WebKit suffers from a use-after-free vulnerability in DocumentFontLoader::fontLoadingTimerFired. https://packetstorm.news/download/188628...
QNAP Symlink Remote Code Execution
The QNAP operating system suffers from a symlinking vulnerability. It is possible to upload a symlink trough a ZIP file and abuse the encrypt/decrypt function to gain an arbitrary file write primitive which can be turned into remote code execution. An attacker with privileges of a regular user ca...
Qsync Central Path Traversal / Information Disclosure
Qsync Central suffers from a symlink attack via an uploaded zip file that results in traversal and information disclosure. Qsync Central versions 4.4.0.1620240819 2024/08/19 and later address this issue. https://packetstorm.news/download/188634...
Zed Attack Proxy 2.16.0 Cross Platform Package
The Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testin...
Adobe Commerce 2.4.7 XML Injection / Code Execution
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an improper restriction of XML External Entity Reference XXE vulnerability that could result in arbitrary code execution. https://packetstorm.news/download/188633...
CISA: 2019 ISC Annual Review
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: 2021 Edition - Planning and Response to an Active Shooter: an Interagency Security Committee Policy and Best Practices Guide
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Chemical Facility Anti-Terrorism Standards (CFATS) Risk Tiering
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: OBP Training Fact Sheet
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Chemical Facility Anti-Terrorism Standards (CFATS) Deep Dive
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: 2019 Edition - Violence in the Federal Workplace: Appendices A, B, and C: Awareness, Resources, and Case Studies
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: 2022 Summit: ChemLock Overview
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Weather Hazard Preparedness
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: the Academy as Catalyst in Promoting and Chemical Security Culture through National and International Collaboration
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: CISA SBOM-A-Rama Day 1 Slides
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Cybersecurity for Physical Security Professionals
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Chemical Sector Cyber Risk Briefing
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Reducing the Threat of Improvised Explosive Device Attacks by Restricting Access to Explosive Precursor Chemicals
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Federally Sponsored C-IED Training and Education Resources Catalog
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Actions to Improve Chemical Facility Safety and Security - a Shared Commitment (Report for the President, May 2014)
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: STS Scenarios Workshop 1 Scenario 2 a Fragmented World
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Autonomous Ground Vehicle Security Guide: Transportation Systems Sector
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Emerging Risks: the Cyber-Physical Drone Threat
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: November 2014/1st Edition - Best Practices for Working with Lessors: an Interagency Security Committee Guide
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Mitigating Attacks on Houses of Worship Security Guide
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: February 2015/1st Edition - Presidential Policy Directive 21 Implementation: an Interagency Security Committee White Paper
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: Transportation Security Administration Surface Operations Overview
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...
CISA: DHS-DOJ Bomb Threat Guidance Quad-Fold
System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...