VMware vRealize Operations Manager Log4shell Remote Code Execution Vulnerability Exploit |
JNDI features used in configuration, log messages, and parameters present in Apache Log4j2 do not protect against attacker controlled LDAP and other JNDI related endpoints. This library, used by VMware vRealize Operations Manager, allows unauthenticated attackers to execute system commands. |
December 13, 2021 |
CVE-2021-44228 |
Linux |
Exploits / Remote Code Execution |
Impact |
Microsoft Exchange TypedBinaryFormatter Deserialization Remote Code Execution Vulnerability Exploit |
A deserialization vulnerability present in the TypedBinaryFormatter class allows authenticated remote attackers to execute arbitrary OS commands with SYSTEM user privileges. |
December 10, 2021 |
CVE-2021-42321 |
Windows |
Exploits / Remote Code Execution |
Impact |
Microsoft Windows Kernel ObpCreateSymbolicLinkName Denial of Service Exploit Update |
This module leverages on a race condition in the Windows kernel using symbolic links to crash the system.
This update adds the CVE number |
December 10, 2021 |
CVE-2021-41335 |
Windows |
Denial of Service / Local |
Impact |
Wordpress <4.9.6 Arbitrary File Delete CVE-2018-12895 |
Wordpress |
December 9, 2021 |
|
|
Exploits / Remote |
SCADAPRO |
PHPMyAdmin CVE-2018-12613 |
PHPMyAdmin Remote Code Execution |
December 9, 2021 |
|
Windows, Linux |
Exploits / Remote Code Execution |
SCADAPRO |
Handysoft Co., Ltd Groupware HShell.dll Remote Code Execution Vulnerability |
This module will receive HTTP requests from vulnerable clients and install agents on them. |
December 9, 2021 |
CVE-2021-26608 |
|
Exploits / Client Side |
SCADAPRO |
GitLab 13.10.2 - Remote Code Execution |
CVE-2021-22205 An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
Tested on GitLab CE 13.10.2 |
December 9, 2021 |
|
|
Exploits / Remote Code Execution |
SCADAPRO |
Soyal VisualProx Access Control Denial of Service |
Remote Denial Soyal VisualProx Access Control |
December 9, 2021 |
|
Windows |
Denial of Service / Remote |
SCADA |
Eaton Visual Designer v7.1 software Remote Code Execution Vulnerability |
This module will receive HTTP requests from vulnerable clients and install agents on them. |
December 9, 2021 |
|
|
Exploits / Client Side |
SCADA |
Eaton Lean Automation XP12inDemoProgram Directory Traversal and file disclosure Vulnerability |
This module exploits a directory traversal vulnerability in Eaton Automation XP12inDemoProgram |
December 9, 2021 |
|
Windows |
Exploits / Remote |
SCADA |
Linux Kernel Netfilter Xt Compat Target From User Local Privilege Escalation Exploit |
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
|
December 1, 2021 |
CVE-2021-22555 |
Linux |
Exploits / Local |
Impact |
Atlassian Confluence Webwork OGNL Injection Vulnerability Exploit |
An OGNL injection vulnerability in Confluence Server and Data Center allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. |
November 25, 2021 |
CVE-2021-26084 |
Linux, Windows |
Exploits / Remote Code Execution |
Impact |
Canon Printer TR150 Driver Local Privilege Escalation Exploit |
The Canon TR150 print driver is vulnerable to a privilege escalation issue. During the add printer process an attacker can overwrite a DLL and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. |
November 18, 2021 |
CVE-2021-38085 |
Windows |
Exploits / Local |
Impact |
Mitsubishi Electric and INEA SmartRTU Source Code Disclosure Vulnerability |
Mitsubishi Electric meets these demands with the smartRTU. It supports protocols such as DNP3 and IEC 60870. The smart- RTU combines the reliability and robustness of our standard PLC technology with a smart communication gateway, the ME-RTU gateway. |
November 12, 2021 |
CVE-2021-40382 |
|
Exploits / Client Side |
SCADAPRO |
Atlassian Jira Server/Data Center 8.16.0 - Cross-Site Scripting |
CVE-2021-26078 The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via across site scripting (XSS) vulnerability. |
November 12, 2021 |
|
|
Exploits / Remote |
SCADAPRO |
Jeedom 4.1.19 Authenticated Privilege Escalation |
Jeedom 4.1.19 Dashboard Authorized Privilege Escalation |
November 12, 2021 |
|
|
Exploits / Remote |
SCADAPRO |
Delta Industrial Automation COMMGR (ModBus) 1.08 Denial of Service |
Remote Denial Delta Industrial Automation COMMGR |
November 12, 2021 |
|
Windows |
Denial of Service / Remote |
SCADAPRO |
Confluence 7.12.2 - Arbitrary File Read |
CVE-2021-26085 Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
Tested against Atlassian Confluence 7.12.2 |
November 12, 2021 |
|
|
Exploits / Remote File Disclosure |
SCADAPRO |
ECOA Building Automation System Config file download |
ECOA Building Automation System configuration download |
November 12, 2021 |
|
|
Exploits / Client Side |
SCADA |
CVE-2021-42013 |
CVE-2021-41773 It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. |
November 12, 2021 |
|
|
Exploits / Remote Code Execution |
SCADA |
B&R Automation Studio WebServer Denial of Service 0-Day |
Remote Denial Automation Studio WebServer |
November 12, 2021 |
|
Windows |
Denial of Service / Remote |
SCADA |
Apache 2.4.49-50 Remote Code Execution |
A Remote Code Execution exploit against Windows target with Apache 2.4.49-50 using CVE-2021-41773 and CVE-2021-42013 |
November 12, 2021 |
|
Windows |
Exploits / Remote Code Execution |
SCADA |
TG8 Firewall Remote Code Execution |
TG8 Firewall allows remote unauthenticated users to execute arbitrary code on the remote device |
November 12, 2021 |
|
|
Exploits / Remote |
IOT |
PLANEX CS-QP50F-ING2 Security Surveillance Smart Camera Remote Configuration Disclosure |
PLANEX CS-QP50F-ING2 Camera Remote Configuration Disclosure |
November 12, 2021 |
|
|
Exploits / Client Side |
IOT |
Denver IP Camera SHO-110 Unauthenticated Snapshot |
Denver IP Camera SHO-110 Unauthenticated Snapshot |
November 12, 2021 |
|
|
Exploits / Client Side |
IOT |