This module exploits a deserialization vulnerability in Oracle WebLogic Server that allows for remote code execution. An unauthenticated attacker with network access to the Oracle WebLogic Server T3 interface can send a serialized object to execute code on vulnerable hosts.

An improper authorization vulnerability in Atlassian Confluence allows unauthenticated remote attackers to restore the database of the instance. This allows the creation of unauthorized administrator accounts and the later installation of malicious plugins that allow the execution of OS system commands.

A broken access control vulnerability in Atlassian Confluence allows unauthenticated remote attackers to create unauthorized Confluence administrator accounts and access Confluence instances. This allows to execute system commands by installing a malicious Servlet plugin JAR file.

This update adds the CVE-2023-21554 to the vulnerabilities exploited by the module. Also Windows Server 2019 was added to supported systems.

Arcserve UDP from version 7.0 to 9.0 allows authentication bypass. The method getVersionInfo in WebServiceImpl/services/FlashServiceImpl exposes the AuthUUID token. This token can be used at /WebServiceImpl/services/VirtualStandbyServiceImpl to obtain a valid session. It is also possible to obtain administrator credentials.

This module exploits a remote stack-based buffer overflow in Wavelink Avalanche Manager by sending a malformed packet to the 1777/TCP port.

A stack buffer overflow in ns_aaa_gwtest_get_event_and_target_names function of nsppe process allows unauthenticated attacker to execute system commands as root via specially crafted HTTP GET request.

A denial of service vulnerability exists in DHCPv6 service when an unauthenticated attacker connects to the target system and sends specially crafted requests.

Vulnerability in Oracle WebLogic Server (component: Core).

The vulnerability can be exploited through the T3/IIOP protocol network, which transfers information between WebLogic servers and other Java programs.

This vulnerability found in Oracle WebLogic Server can lead to remote code execution.

A denial of service vulnerability exists in Microsoft Message Queuing when an unauthenticated attacker connects to the target system and sends specially crafted requests.