what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 39 RSS Feed

Files Date: 2023-06-12

Oracle Weblogic PreAuth Remote Command Execution
Posted Jun 12, 2023
Authored by Grant Willcox, 4ra1n, 14m3ta7k | Site metasploit.com

Oracle Weblogic versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated remote code execution vulnerability due to a post deserialization vulnerability. This Metasploit module exploits this vulnerability to trigger the JNDI connection to a LDAP server you control. The LDAP server will then respond with a remote reference response that points to a HTTP server that you control, where the malicious Java class file will be hosted. Oracle Weblogic will then make an HTTP request to retrieve the malicious Java class file, at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate an instance of that class, granting us remote code execution as the oracle user.

tags | exploit, java, remote, web, code execution
advisories | CVE-2023-21839
SHA-256 | bf2f1b516a8dc0fb1cbfbd5fd5ff2f96c261f01313c61be63baa18eaf950b757
TerraMaster TOS 4.2.15 Remote Code Execution
Posted Jun 12, 2023
Authored by n0tme, h00die-gr3y | Site metasploit.com

This Metasploit module is a Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected.

tags | exploit, code execution
advisories | CVE-2021-45837, CVE-2021-45839, CVE-2021-45841
SHA-256 | 7ed27419eb63bc961b9030c2afefd618737ab612eeb1c26228002425218d88af
TerraMaster TOS 4.2.06 Remote Code Execution
Posted Jun 12, 2023
Authored by IHTeam, h00die-gr3y | Site metasploit.com

This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS versions 4.2.06 and below via shell metacharacters in the Event parameter at vulnerable endpoint include/makecvs.php during CSV creation. Any unauthenticated user can therefore execute commands on the system under the same privileges as the web application, which typically runs under root at the TerraMaster Operating System.

tags | exploit, remote, web, shell, root, php, code execution
advisories | CVE-2020-28188, CVE-2020-35665
SHA-256 | 8935d1e9f61d6f9eb3550ec44e1a8a5d97992b91e55a7456ae2af009097db539
Anevia Flamingo XL 3.2.9 Remote Root Jailbreak
Posted Jun 12, 2023
Authored by LiquidWorm | Site zeroscience.mk

Anevia Flamingo XL version 3.2.9 suffers from an SSH sandbox escape via the use of traceroute. A remote attacker can breakout of the restricted environment and have full root access to the device.

tags | exploit, remote, root
SHA-256 | d01a03802c6672cc17ac7216582cc0ad2e643d89808e99df7c959276e761db6d
Anevia Flamingo XL 3.6.20 Authenticated Root Remote Code Execution
Posted Jun 12, 2023
Authored by LiquidWorm | Site zeroscience.mk

Anevia Flamingo XL version 3.6.20 suffers from an authenticated remote code execution vulnerability. A remote attacker can exploit this issue and execute arbitrary system commands granting her system access with root privileges.

tags | exploit, remote, arbitrary, root, code execution
SHA-256 | 43b14f668d4cb3067cebaa36c98d98889067ae017e721f40aa4910c9fb7f8585
Anevia Flamingo XS 3.6.5 Authenticated Root Remote Code Execution
Posted Jun 12, 2023
Authored by LiquidWorm | Site zeroscience.mk

Anevia Flamingo XS version 3.6.5 suffers from an authenticated remote code execution vulnerability. A remote attacker can exploit this issue and execute arbitrary system commands granting her system access with root privileges.

tags | exploit, remote, arbitrary, root, code execution
SHA-256 | 53e095bd8aa1c01d2554ab8f1b300973ebf09ad1794d93fb1b09c6ffe2266f09
Anevia Flamingo XL/XS 3.6.x Default / Hardcoded Credentials
Posted Jun 12, 2023
Authored by LiquidWorm | Site zeroscience.mk

Anevia Flamingo XL/XS versions 3.6.20 and 3.2.9 have a weak set of default and hardcoded administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.

tags | exploit, remote
SHA-256 | 2deadfaf85581a1f50ccbbab6f33e8fcfb1e7bcb2cec62ab73bffe247af5652d
Debian Security Advisory 5423-1
Posted Jun 12, 2023
Authored by Debian | Site debian.org

Debian Linux Security Advisory 5423-1 - Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.

tags | advisory, denial of service, arbitrary
systems | linux, debian
advisories | CVE-2023-34414, CVE-2023-34416
SHA-256 | 39fd28a4e51cf92b07dc048ec4a3a557fdc8493c2998b7bbf52cfb0d34f5d018
Ubuntu Security Notice USN-6153-1
Posted Jun 12, 2023
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 6153-1 - It was discovered that Jupyter Core executed untrusted files in the current working directory. An attacker could possibly use this issue to execute arbitrary code.

tags | advisory, arbitrary
systems | linux, ubuntu
advisories | CVE-2022-39286
SHA-256 | e049b61f2fbb6457ed2a6ddde7ac19490ab8581a30c4ee08fbce8af1f8109ce9
Red Hat Security Advisory 2023-3557-01
Posted Jun 12, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-3557-01 - OpenShift GitOps KAM OpenShift GitOps Kubernetes Application Manager CLI tool. Issues addressed include a bypass vulnerability.

tags | advisory, bypass
systems | linux, redhat
advisories | CVE-2022-1996
SHA-256 | a484b137c49d4be983cc60080e22e27f3968c949feca93d9d4d66179cd80d702
OmniCart 3.4.0 Cross Site Scripting
Posted Jun 12, 2023
Authored by CraCkEr

OmniCart version 3.4.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 7323138488bd4cd451f0dffd691e21b4c0a55eb945acdb7f373e7140c7bef115
LearnDesk 1.0 Cross Site Scripting
Posted Jun 12, 2023
Authored by CraCkEr

LearnDesk version 1.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 7cf650733c542723690c9a00d465a835103eb18d3f78642d33f825488c7b3124
BB Machine Forum 1.0 Cross Site Scripting
Posted Jun 12, 2023
Authored by CraCkEr

BB Machine Forum version 1.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 6315ed904ee3dea27805196e3028564056c12963b3a7f6936d5344758d825387
Expert X Jobs Portal And Resume Builder 1.0 Cross Site Scripting
Posted Jun 12, 2023
Authored by CraCkEr

Expert X Jobs Portal And Resume Builder version 1.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 19f4755eb1dd3a69bc59894dfb38d143b71e2cccaeec50578bedd8040f72b67f
PhotoSwipe 5.3.7 Arbitrary File Download
Posted Jun 12, 2023
Authored by indoushka

PhotoSwipe version 5.3.7 suffers from an arbitrary file download vulnerability.

tags | exploit, arbitrary
SHA-256 | e3c2913294c88ee858084b60305ca64197b66e6c22651f6ce631126b031fceae
PES Pro CMS 1.9.7 Add Administrator
Posted Jun 12, 2023
Authored by indoushka

PES Pro CMS version 1.9.7 suffers from an add administrator vulnerability.

tags | exploit, add administrator
SHA-256 | 3d97f6f0b8f502ed030585d7d6b91ccacf8a0f1ab76836e0c68f38cde0a96e07
KesionCMS X 9.5 Add Administrator
Posted Jun 12, 2023
Authored by indoushka

KesionCMS X version 9.5 suffers from an unauthenticated add administrator vulnerability.

tags | exploit, add administrator
SHA-256 | 024a40520b5fe0b781a7cbf82ba73b871d140c7767554af3aee2a48e9ea18c1b
Pannres-Idence CMS 7.3 Cross Site Request Forgery
Posted Jun 12, 2023
Authored by indoushka

Pannres-Idence CMS version 7.3 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
SHA-256 | f1c42b82bf02fabbfc0466a6bc27d61027562f218a3cc4719bffb478ca5a7d9b
Ormesson-Immobilier CMS 8 SQL Injection
Posted Jun 12, 2023
Authored by indoushka

Ormesson-Immobilier CMS version 8 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

tags | exploit, remote, sql injection
SHA-256 | 387dd9b9671bc18550ca2875160ffe7b6c6242239617019eb08ec20fc1c20332
osCommerce 4 Local File Inclusion
Posted Jun 12, 2023
Authored by indoushka

osCommerce version 4 suffers from a local file inclusion vulnerability.

tags | exploit, local, file inclusion
SHA-256 | 7cbd3f800121fbd6498c3dbdfab0d4d1fc70c2191d3bab9e42181076af739910
WordPress Workreap 2.2.2 Shell Upload
Posted Jun 12, 2023
Authored by Mohammad Hossein Khanaki

WordPress theme Workreap version 2.2.2 suffers from a remote shell upload vulnerabilities.

tags | exploit, remote, shell, vulnerability
advisories | CVE-2021-24499
SHA-256 | 88613ebc6afdbf65ab6006134c141ccea5e75079b6943db66508c59fc8ddd503
VIVO SPARQL Injection
Posted Jun 12, 2023
Authored by GitHub Security Lab

Proof of concept exploit for a SPARQL injection vulnerability in VIVO that triggers a denial of service.

tags | exploit, denial of service, proof of concept
advisories | CVE-2019-6986
SHA-256 | 03a908c86212c5d8cb01cd14ceb44e5ff14b5a0ad5966f87f7b111117d9a3ab6
strongSwan VPN Charon Server Buffer Overflow
Posted Jun 12, 2023
Authored by Kevin Backhouse, GitHub Security Lab

Proof of concept exploit for a buffer overflow in strongSwan VPN's charon server.

tags | exploit, overflow, proof of concept
advisories | CVE-2018-5388
SHA-256 | 381239d433a012d932de3871f064091c52ad26bb7b01de975c5e82fe37562652
librelp Remote Code Execution
Posted Jun 12, 2023
Authored by Kevin Backhouse, GitHub Security Lab, Rainer Gerhards, Bas van Schaik

Proof of concept exploit for a buffer overflow remote code execution vulnerability in librelp.

tags | exploit, remote, overflow, code execution, proof of concept
advisories | CVE-2018-1000140
SHA-256 | e494ed907a60d68aba585cbc21eba08e50daffab41973ff8ba84e679096953dc
polkit File Descriptor Exhaustion
Posted Jun 12, 2023
Authored by GitHub Security Lab

Proof of concept exploit for polkit that triggers an eventfd file descriptor leak.

tags | exploit, proof of concept
advisories | CVE-2021-4115
SHA-256 | f9b681fc933ff4d272ea49c02694d6c797b953465a57f0c30ab341372a92d369
Page 1 of 2
Back12Next

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close