Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function. CVSSv3.1 8.8 (HIGH) · EPSS 77th percentile
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function. CVSSv3.1 8.8 (HIGH) · EPSS 82th percentile
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVSSv3.1 8.3 (HIGH) · EPSS 66th percentile
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain CVSSv3.1 8.6 (HIGH) · EPSS 97th percentile
Volatility 3 v2.5.2 released with new cloud storage layers (Amazon S3, Google Cloud Storage), new plugins for Linux YARA scanning and Windows MFT ADS enumeration, and improvements to ELF file dumping and registry support.
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. CVSSv3.1 8.2 (HIGH)
An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incorrect calculation of the buffer size to store the message, resulting in an application crash. This issue affects glibc 2.37 and newer. CVSSv3.1 8.2 (HIGH) · EPSS 71th percentile
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. This issue affects glibc 2.36 and newer. CVSSv3.1 8.4 (HIGH) · EPSS 96th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9. CVSSv3.1 8.5 (HIGH)
Elastic Security Labs disclosed a December 2023 intrusion (REF0657) targeting a South Asian financial services organization, leveraging MSSQL xp_cmdshell for initial access and employing open-source tools (iox, Rakshasa, NPS), Cobalt Strike via DLL side-loading, and MEGA for data exfiltration. The threat actor established persistence through rogue admin accounts, disabled logging, enabled RDP with pass-the-hash capabilities, and maintained C2 via Supershell infrastructure across seven compromised hosts within 24 hours.
Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device. CVSSv3.1 9.8 (CRITICAL) · EPSS 70th percentile
D-Link DAP-1650 contains an unauthenticated command injection vulnerability in the gena.cgi module when processing UPnP SUBSCRIBE messages, allowing remote attackers to execute arbitrary commands as root. The device is end-of-life with no patches available. Vulnerability was disclosed to vendor in December 2021 and publicly disclosed in January 2024.
D-Link DAP-1650 contains an unauthenticated command injection vulnerability in the UPnP SUBSCRIBE message handler's 'Callback' parameter, allowing remote attackers to execute arbitrary commands as root. The vulnerability was disclosed to the vendor in December 2021 but remains unpatched; the device is end-of-life with no remediation available.
Exodus Intelligence disclosed a command injection vulnerability (CVE-2024-23626) in the Motorola MR2600 network appliance affecting the 'SaveSysLogParams' parameter, allowing remote authenticated attackers to execute arbitrary commands. The vulnerability was disclosed nearly 3 years after vendor notification; the product is end-of-life with no patches available.
An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php CVSSv3.1 9.8 (CRITICAL) · EPSS 57th percentile
An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. No fixed release is available; the project has had no commit since 2024-04-08. CVSSv3.1 8.8 (HIGH) · EPSS 100th percentile
A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this v CVSSv3.1 8.3 (HIGH) · EPSS 91th percentile
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVSSv3.1 6.1 (MEDIUM) · EPSS 98th percentile
An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API. CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile
An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file. CVSSv3.1 9.8 (CRITICAL) · EPSS 58th percentile
An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file. CVSSv3.1 9.8 (CRITICAL) · EPSS 58th percentile
An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component. CVSSv3.1 9.8 (CRITICAL) · EPSS 65th percentile
An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allows attackers to execute arbitrary code via uploading a crafted file. CVSSv3.1 9.8 (CRITICAL) · EPSS 58th percentile
YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScript() method. CVSSv3.1 9.8 (CRITICAL) · EPSS 46th percentile