Pulse Secure SSL VPN Arbitrary File Disclosure Exploit |
This exploit leverages a vulnerability in Pulse Secure which allows an unauthenticated remote attacker to send a specially crafted URI to perform an arbitrary file reading vulnerability. |
January 14, 2021 |
CVE-2018-13379 |
Linux |
Exploits / Remote File Disclosure |
Impact |
Fortinet FortiOS Path Traversal Exploit (CVE-2018-13379) |
A path traversal vulnerability in the FortiOS SSL VPN web portal may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. |
January 12, 2021 |
CVE-2018-13379 |
Linux |
Exploits / Remote File Disclosure |
Impact |
Advantech ActiveDAQ Pro AdvGraph.dll Remote Code Execution Vulnerability Exploit |
This module will receive HTTP requests from vulnerable clients and install agents on them. |
January 11, 2021 |
|
|
Exploits / Client Side |
SCADAPRO |
Schneider Electric ProWORX 32 DXFREADERlib DXFReader.ocx Remote File Create Vulnerability |
This module will receive HTTP requests from vulnerable clients and install agents on them. |
January 11, 2021 |
|
|
Exploits / Client Side |
SCADAPRO |
Tiandy IP Cameras Sensitive Information Disclosure |
Tiandy IP Cameras 5.56.17.120 - Sensitive Information Disclosure |
January 11, 2021 |
CVE-2017-15236 |
|
Exploits / Client Side |
IOT |
SV3C L-Series HD Camera Remote Configuration Disclosure |
SV3C L-Series HD Camera Remote Configuration Disclosure |
January 11, 2021 |
CVE-2018-12671 |
|
Exploits / Client Side |
IOT |
TBK DVR4104 and DVR4216 Credentials Leak |
TBK DVR4104 and DVR4216 Credentials Leak |
January 11, 2021 |
CVE-2018-9995 |
Windows |
Exploits / Remote |
IOT |
Tellion HN-2204AP Router Remote Configuration Disclosure Exploit |
Tellion HN-2204AP Router Remote Configuration Disclosure |
January 11, 2021 |
|
|
Exploits / Client Side |
IOT |
D-Link DCS-2103 Network Ip Camera Directory Traversal Vulnerability |
This module exploits a directory traversal vulnerability in D-Link DCS-2103 |
January 11, 2021 |
|
Windows |
Exploits / Remote |
IOT |
Microsoft Windows CloudExperienceHost Elevation of Privilege Vulnerability Exploit |
An elevation of privilege vulnerability exists when Microsoft Windows CloudExperienceHost fails to check COM objects. |
January 8, 2021 |
CVE-2020-1471 |
Windows |
Exploits / Local |
Impact |
Microsoft Windows splwow64 Untrusted Pointer Dereference Privilege Escalation Exploit |
The specific flaw exists within the user-mode printer driver host process splwow64.exe. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to escalate privileges from low integrity and execute code in the context of the current user at medium integrity. |
December 16, 2020 |
CVE-2020-0986 |
Windows |
Exploits / Local |
Impact |
Ghostcat Local File Inclusion Exploit |
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. |
December 16, 2020 |
CVE-2020-1938 |
Windows |
Exploits / Local File Inclusion |
Impact |
Microsoft Windows WalletService Elevation of Privilege Vulnerability Exploit |
An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. |
December 16, 2020 |
CVE-2020-1362 |
Windows |
Exploits / Local |
Impact |
Rievtech Electronic xLogic Software Denial of service |
Remote Denial Rievtech Electronic xLogic version 3.3.5.0 |
December 3, 2020 |
|
Windows |
Denial of Service / Remote |
SCADAPRO |
Schneider Electric U.Motion Builder 1.3.4 Unauthenticated Command Injection |
The script track_import_export.php is vulnerable to an unauthenticated command injection vulnerability when user-supplied input to the HTTP GET/POST parameter object_id is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to inject arbitrary commands into a PHP exec call. This is a bypass to the fix implemented for CVE-2018-7765. |
December 3, 2020 |
CVE-2018-7765 |
|
Exploits / Remote |
SCADA |
xArrow v3.2 Web Server Denial of Service |
Denial of service xArrow Web Server Exploit |
December 3, 2020 |
|
Windows |
Denial of Service / Remote |
SCADAPRO |
ESCAM QD-900 WIFI HD Camera Remote Configuration Disclosure |
ESCAM QD-900 WIFI HD Camera Remote Configuration Disclosure |
December 3, 2020 |
|
|
Exploits / Client Side |
IOT |
Foscam Cameras Denial of service of the RTSP video feed |
Denial of service RTSP in Foscam Cameras Exploit |
December 3, 2020 |
|
Windows |
Denial of Service / Remote |
IOT |
Edimax EW-7438RPn Information Disclosure |
Edimax EW-7438RPn credential disclosure vulnerability |
December 3, 2020 |
|
|
Exploits / Client Side |
IOT |
Genie Access WIP3BVAF IP Camera Directory Traversal Vulnerability |
This module exploits a directory traversal vulnerability in Genie Access WIP3BVAF IP camera |
December 3, 2020 |
CVE-2019-7315 |
Windows |
Exploits / Remote |
IOT |
Geutebruck IP Camera Remote Reboot Vulnerability |
Geutebruck IP Camera Remote Reboot Vulnerability |
December 3, 2020 |
CVE-2018-7520 |
|
Exploits / Client Side |
IOT |
Microsoft Windows Bad Neighbor DoS Exploit |
A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets, aka 'Windows TCP/IP Remote Code Execution Vulnerability'.
|
November 12, 2020 |
CVE-2020-16898 |
Windows |
Denial of Service / Remote |
Impact |
Microsoft SharePoint Server WebParts Deserialization TypeConverters Vulnerability Exploit (CVE-2020-0932) |
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.
Exploitation of this vulnerability requires that a user uploads a specially crafted SharePoint application package to an affected version of SharePoint. |
November 6, 2020 |
CVE-2020-0932 |
Windows |
Exploits / OS Command Injection / Known Vulnerabilities |
Impact |
SoftPLC Web Studio Mobile Access Denial of Service |
Remote Denial Of Service in SoftPLC Web Studio Mobile Access |
November 5, 2020 |
|
Windows |
Denial of Service / Remote |
SCADAPRO |
Lukefluke Fitness Manager Database Denial of service |
Remote Denial Of Service in Firebird |
November 5, 2020 |
|
Windows |
Denial of Service / Remote |
MEDICAL |