CVE-2020-7384

Summary of CVE-2020-7384 (Metasploit msfvenom APK Template Command Injection) : The vulnerability affects Rapid7’s Metasploit Framework, specifically the msfvenom APK template feature. The issue arises from unsanitized input in template handling (Owner field) that flows into a process invocation ...

CVE-2020-7350

CVE-2020-7350 affects Rapid7 Metasploit Framework libnotify plugin. Versions before 5.0.85 allow OS command injection via untrusted data in a remote hostname/service name; an attacker must supply a crafted file processed by db_import to trigger code execution on the operator’s terminal. A fix was...

CVE-2020-7385

The CVE-2020-7385 issue affects Metasploit Framework via a deserialization flaw triggered when the drb_remote_codeexec module is used. The vulnerability stems from reliance on vulnerable Distributed Ruby class functions, and Metasploit is typically run with elevated privileges, enabling potential...

CVE-2019-5642

CVE-2019-5642 affects Rapid7 Metasploit Pro (versions 4.16.0-2019081901 and earlier). The issue is CWE-732: during installation, the web server SSL server.key is written to the filesystem with world-readable permissions, enabling other local users to intercept private communications to the Metasp...

CVE-2020-7355

CVE-2020-7355 is a stored XSS vulnerability in Rapid7 Metasploit Pro’s discovered scan asset notes field. The issue allows an attacker to inject a script via a specially crafted network service, triggering when a user views the scanned host record in the Metasploit Pro interface. Affected: Metasp...

CVE-2020-7354

Rapid7 Metasploit Pro contains a stored-XSS vulnerability in the host field of a discovered scan asset. An attacker who can reach a target’s network service can craft input that stores an XSS sequence, which executes when an operator views the scanned host record in the Metasploit Pro console. A ...