CVE-2021-42013 |
CVE-2021-41773 It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. |
November 12, 2021 |
|
|
Exploits / Remote Code Execution |
SCADA |
B&R Automation Studio WebServer Denial of Service 0-Day |
Remote Denial Automation Studio WebServer |
November 12, 2021 |
|
Windows |
Denial of Service / Remote |
SCADA |
Apache 2.4.49-50 Remote Code Execution |
A Remote Code Execution exploit against Windows target with Apache 2.4.49-50 using CVE-2021-41773 and CVE-2021-42013 |
November 12, 2021 |
|
Windows |
Exploits / Remote Code Execution |
SCADA |
TG8 Firewall Remote Code Execution |
TG8 Firewall allows remote unauthenticated users to execute arbitrary code on the remote device |
November 12, 2021 |
|
|
Exploits / Remote |
IOT |
PLANEX CS-QP50F-ING2 Security Surveillance Smart Camera Remote Configuration Disclosure |
PLANEX CS-QP50F-ING2 Camera Remote Configuration Disclosure |
November 12, 2021 |
|
|
Exploits / Client Side |
IOT |
Denver IP Camera SHO-110 Unauthenticated Snapshot |
Denver IP Camera SHO-110 Unauthenticated Snapshot |
November 12, 2021 |
|
|
Exploits / Client Side |
IOT |
Cisco HyperFlex Data Platform Installer Command Injection Vulnerability Exploit |
The password input field in the "/auth/" and "/auth/change" endpoints of Cisco HyperFlex HX Installer Virtual Machine allow an unauthenticated attacker to execute systems commands as root. |
November 10, 2021 |
CVE-2021-1497 |
Linux |
Exploits / Remote Code Execution |
Impact |
Apache HTTP Server Path Traversal Bypass File Disclosure Exploit |
A path traversal vulnerability in Apache HTTP server may allow an unauthenticated attacker to download system files through specially crafted HTTP resource requests.
This vulnerability is a bypass of CVE-2021-41773. |
November 3, 2021 |
CVE-2021-42013 |
Linux |
Exploits / Remote File Disclosure |
Impact |
Microsoft Exchange Proxyshell Remote Code Execution Vulnerability Exploit |
A combination of a path confusion that leads to an authentication bypass (ACL), an elevation of privilege and an arbitrary file write vulnerability, allows unauthenticated attackers to execute commands with SYSTEM privileges in Microsoft Exchange Server. |
October 29, 2021 |
CVE-2021-31207 |
Windows |
Exploits / Remote Code Execution |
Impact |
Microsoft Windows win32kbase Use After Free MisterySnail NtGdiResetDC Privileged Escalation Exploit |
CVE-2021-40449 is a use-after-free vulnerability in Win32k's NtGdiResetDC function. As with many other Win32k vulnerabilities, the root cause of this vulnerability lies in the ability to set user-mode callbacks and execute unexpected API functions during execution of those callbacks. The CVE-2021-40449 is triggered when the function ResetDC is executed a second time for the same handle during execution of its own callback. |
October 27, 2021 |
CVE-2021-40449 |
Windows |
Exploits / Local |
Impact |
Microsoft MSHTML Remote Code Execution Exploit Update |
This is a critical vulnerability in the MSHTML rendering engine. Microsoft Office applications use the MSHTML engine to process and display web content. An adversary who successfully exploits could achieve full control over a target system by using malicious ActiveX controls to execute arbitrary code.
This Update contains the following improvements:
-Default Connection method was changed to HTTPS
-Early Release Warning was removed
-Several "Application Name" in "Supported systems" property were added |
October 21, 2021 |
CVE-2021-40444 |
Windows |
Exploits / Client Side |
Impact |
Apache HTTP Server Path Traversal Exploit CVE-2021-41773 |
A path traversal vulnerability in Apache HTTP server may allow an unauthenticated attacker to download system files through specially crafted HTTP resource requests. |
October 15, 2021 |
CVE-2021-41773 |
Linux |
Exploits / Remote File Disclosure |
Impact |
Open Management Infrastructure OMIGOD Remote Code Execution Exploit |
A remote code execution vulnerability exists in OMI. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted request to a vulnerable service over a publicly accessible remote management port.
|
October 13, 2021 |
CVE-2021-38647 |
Linux |
Exploits / Remote Code Execution |
Impact |
Rencode Denial Of Service |
This module causes a Denial of Service in rencode python library |
October 8, 2021 |
|
Windows |
Denial of Service / Remote |
SCADAPRO |
Pelco Digital Sentry Server Remote Arbitrary File Overwrite |
This module will receive HTTP requests from vulnerable clients and install agents on them. |
October 8, 2021 |
|
|
Exploits / Client Side |
SCADAPRO |
Confluence Server 7.12.4 - Remote Code Execution (Unauthenticated) |
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
Tested against Confluence 7.12.3 |
October 8, 2021 |
|
|
Exploits / Remote Code Execution |
SCADAPRO |
Siemens WinCC TIA Portal v13-v16 Remote Denial of Service |
This modules causes a Denial of Service in CCAgent.exe Siemens WinCC TIA Portal. |
October 8, 2021 |
CVE-2019-19282 |
Linux |
Denial of Service / Remote |
SCADA |
SEL AcSELerator Architect 2.2.24 CPU Exhaustion Denial of Service |
This module causes a Denial of Service in SEL AcSELerator Architect |
October 8, 2021 |
|
Windows |
Denial of Service / Remote |
SCADA |
ARSoft Visual IO SCADA DDE Server Denial of Service |
Remote Denial ARSoft Visual IO SCADA DDE Server |
October 8, 2021 |
|
Windows |
Denial of Service / Remote |
SCADA |
Apache 2.4.49 Remote Code Execution |
CVE-2021-41773 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue only affects Apache 2.4.49 and not earlier versions. |
October 8, 2021 |
|
|
Exploits / Remote Code Execution |
SCADA |
SeowoninTech Seowon 130-SLC router Unauthenticated Command Execution |
Execute commands without authentication as admin user , To use it in all versions, we only enter the router ip and Port(if available) in the request. The result of the request is visible on the browser page |
October 8, 2021 |
|
|
Exploits / Remote |
IOT |
Positive Technologies Maxpatrol 8 and Xspider Remote Denial Of Service exploit |
Remote Denial Of Service in Maxpatrol 8 and Xspider |
October 8, 2021 |
|
Windows |
Denial of Service / Remote |
IOT |
ARD-9808 DVR Card Security Camera Password Disclosure Vulnerability |
ARD-9808 DVR Card Security Camera Information Disclosure vulnerability |
October 8, 2021 |
|
|
Exploits / Client Side |
IOT |
Microsoft Windows Kernel ObpCreateSymbolicLinkName Denial of Service Exploit |
This module leverages on a race condition in the Windows kernel using symbolic links to crash the system. |
October 6, 2021 |
NOCVE-9999-165500 |
Windows |
Denial of Service / Local |
Impact |
VMware vCenter Server Reverse Proxy Bypass File Upload Remote Code Execution Exploit |
A reverse proxy bypass vulnerability allows attackers to access restricted endpoints as declared in the analytics-proxy.conf file.
Combined with a unrestricted file upload vulnerability present in the DataAppAgentController class, when using the action=collect parameter, allows attackers to execute systems commands as root. |
October 1, 2021 |
CVE-2021-22006 |
Linux |
Exploits / Remote |
Impact |