A vulnerability in the library Apache Santuario SAML SSO (Single Sign-On) method used by Zoho ManageEngine products allows to unauthenticated remote code attackers to execute system commands. This modules uses a specially crafted SAML against Zoho ManageEngine ServiceDesk Plus to execute system commands to deploy an agent. The deployed agent will run with the root user account privileges on Linux systems and with SYSTEM privileges on Windows systems.
An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
This module uses NTLM reflection to achieve a SYSTEM handle for elevation of privilege.
This module can be used to perform a privilege escalation using a misconfiguration on the Object Authorities of a User profile.
CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
This module exploits an Arbitrary File Deletion performed by an unprivileged user in any protected folder. Before deleting the file, this module backups the file in the user temp folder
A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege escalation problem.
This module exploits a deserialization vulnerability present in Microsoft.Exchange.Data.SerializationTypeConverter class when converting powershell remoting objects. This module bypasses the IIS URL Rewrite rules given by Microsoft. This is achieved by not using the autodiscover path confusion (CVE-2022-41040). The deployed agent will run with the SYSTEM privileges.