Microsoft Windows splwow64 Untrusted Pointer Dereference Privilege Escalation Exploit |
The specific flaw exists within the user-mode printer driver host process splwow64.exe. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to escalate privileges from low integrity and execute code in the context of the current user at medium integrity. |
December 16, 2020 |
CVE-2020-0986 |
Windows |
Exploits / Local |
Impact |
Ghostcat Local File Inclusion Exploit |
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. |
December 16, 2020 |
CVE-2020-1938 |
Windows |
Exploits / Local File Inclusion |
Impact |
Microsoft Windows WalletService Elevation of Privilege Vulnerability Exploit |
An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. |
December 16, 2020 |
CVE-2020-1362 |
Windows |
Exploits / Local |
Impact |
Rievtech Electronic xLogic Software Denial of service |
Remote Denial Rievtech Electronic xLogic version 3.3.5.0 |
December 3, 2020 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name= |
Windows |
Denial of Service / Remote |
SCADAPRO |
Schneider Electric U.Motion Builder 1.3.4 Unauthenticated Command Injection |
The script track_import_export.php is vulnerable to an unauthenticated command injection vulnerability when user-supplied input to the HTTP GET/POST parameter object_id is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to inject arbitrary commands into a PHP exec call. This is a bypass to the fix implemented for CVE-2018-7765. |
December 3, 2020 |
CVE-2018-7765 |
|
Exploits / Remote |
SCADA |
xArrow v3.2 Web Server Denial of Service |
Denial of service xArrow Web Server Exploit |
December 3, 2020 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name= |
Windows |
Denial of Service / Remote |
SCADAPRO |
ESCAM QD-900 WIFI HD Camera Remote Configuration Disclosure |
ESCAM QD-900 WIFI HD Camera Remote Configuration Disclosure |
December 3, 2020 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name= |
|
Exploits / Client Side |
IOT |
Foscam Cameras Denial of service of the RTSP video feed |
Denial of service RTSP in Foscam Cameras Exploit |
December 3, 2020 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name= |
Windows |
Denial of Service / Remote |
IOT |
Edimax EW-7438RPn Information Disclosure |
Edimax EW-7438RPn credential disclosure vulnerability |
December 3, 2020 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name= |
|
Exploits / Client Side |
IOT |
Genie Access WIP3BVAF IP Camera Directory Traversal Vulnerability |
This module exploits a directory traversal vulnerability in Genie Access WIP3BVAF IP camera |
December 3, 2020 |
CVE-2019-7315 |
Windows |
Exploits / Remote |
IOT |
Geutebruck IP Camera Remote Reboot Vulnerability |
Geutebruck IP Camera Remote Reboot Vulnerability |
December 3, 2020 |
CVE-2018-7520 |
|
Exploits / Client Side |
IOT |
Microsoft Windows Bad Neighbor DoS Exploit |
A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets, aka 'Windows TCP/IP Remote Code Execution Vulnerability'.
|
November 12, 2020 |
CVE-2020-16898 |
Windows |
Denial of Service / Remote |
Impact |
Microsoft SharePoint Server WebParts Deserialization TypeConverters Vulnerability Exploit (CVE-2020-0932) |
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.
Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. |
November 6, 2020 |
CVE-2020-0932 |
Windows |
Exploits / OS Command Injection / Known Vulnerabilities |
Impact |
SoftPLC Web Studio Mobile Access Denial of Service |
Remote Denial Of Service in SoftPLC Web Studio Mobile Access |
November 5, 2020 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name= |
Windows |
Denial of Service / Remote |
SCADAPRO |
Lukefluke Fitness Manager Database Denial of service |
Remote Denial Of Service in Firebird |
November 5, 2020 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name= |
Windows |
Denial of Service / Remote |
MEDICAL |
Grandstream Audio Conferencing Unit Remote Reboot Vulnerability |
The following Grandstream devices are vulnerable to unauthenticated remote code execution by the combination of a command injection vulnerability and an authentication bypass |
November 5, 2020 |
CVE-2019-10655 |
|
Exploits / Client Side |
IOT |
Grandstream UCM6204 IP PBX Remote Reboot Vulnerability |
Grandstream UCM6204 IP PBX Remote Reboot Vulnerability |
November 5, 2020 |
CVE-2019-10662 |
|
Exploits / Client Side |
IOT |
GECKO Lite Managed switch Configuration Disclosure |
GECKO Lite Managed switch Remote Configuration Disclosure |
November 5, 2020 |
CVE-2017-5163 |
|
Exploits / Client Side |
IOT |
Humax Wi-Fi Router HG100R credential disclosure vulnerability |
Humax Wi-Fi Router credential disclosure vulnerability |
November 5, 2020 |
CVE-2017-11435 |
|
Exploits / Client Side |
IOT |
Insteon HD WiFI Camera Denial of Service |
Remote Denial Of Service in Insteon HD WiFI Camera |
November 5, 2020 |
https://cve.mitre.org/cgi-bin/cvename.cgi?name= |
Windows |
Denial of Service / Remote |
IOT |
Oracle Weblogic Server MBeanUtilsInitSingleFileServlet service Vulnerability Remote Code Execution Exploit Update |
Oracle WebLogic Server is prone to a remote vulnerability that allows unauthenticated attackers to execute system commands.
By exploiting known methods, it is possible to remotely instantiate several java classes that allows to execute system commands.
This update improves code readability and adds a bypass for CVE-2020-14750. |
November 5, 2020 |
CVE-2020-14882 |
Windows, Linux |
Exploits / Remote |
Impact |
Oracle Weblogic Server MBeanUtilsInitSingleFileServlet service Vulnerability Remote Code Execution Exploit |
Oracle WebLogic Server is prone to a remote vulnerability that allows unauthenticated attackers to execute system commands.
By exploiting known methods, it is possible to remotely instantiate several java classes that allows to execute system commands. |
November 3, 2020 |
CVE-2020-14882 |
Windows, Linux |
Exploits / Remote |
Impact |
Microsoft Windows DNS Server SIGRed Local Privilege Escalation Exploit Update |
This update adds support for Windows Server 2008 Enterprise Edition SP2 - x86-64. |
October 21, 2020 |
CVE-2020-1350 |
Windows |
Exploits / Local |
Impact |
Microsoft SharePoint Server CreateChildControls Server Side Include Vulnerability Exploit (CVE-2020-16952) |
A server-side include in Microsoft SharePoint via CreateChildControls in DataFormWebPart class allows an authenticated user to leak the web.config file and forge a malicious ViewState with the extracted validation key.
The user credentials requires user with page creation privileges, a standard permission. |
October 16, 2020 |
CVE-2020-16952 |
Windows |
Exploits / OS Command Injection / Known Vulnerabilities |
Impact |
Microsoft SharePoint Server WikiContentWebpart Web Part Remote OS Command Injection Exploit (CVE-2020-1181) |
A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'. |
October 16, 2020 |
CVE-2020-1181 |
Windows |
Exploits / OS Command Injection / Known Vulnerabilities |
Impact |