This module uses a reverse proxy bypass vulnerability to access restricted endpoints as declared in the analytics-proxy.conf file. Also, it uses an unauthenticated file upload vulnerability present in the DataAppAgentController class, when using the action=collect parameter. The deployed agent will run with root privileges.

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).

A vulnerability in Pulse Connect Secure could allow an authenticated administrator to perform a file write via a maliciously crafted archive uploaded in the administrator web interface. The deployed agent will run with ROOT privileges.

A vulnerability in the admin web interface could allow an authenticated attacker to upload a custom template to perform an arbitrary code execution. These templates can be used to display customised login and meeting pages and are rendered using the Perl Template Toolkit engine. This engine can be coerced into executing code by creating a new "BLOCK" by abusing the "template" global object to create a new block to be evaluated. The deployed agent will run with ROOT privileges.

This module first uses hard-coded credentials for the diagnostics user to authenticate in the UCMDB component. Then a java deserialization vulnerability present in several endpoints of the UCMDB service is used to execute commands. The deployed agent will run with the SYSTEM privileges on Windows and root on Linux.

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

This module uses an unauthenticated remote PHP file upload vulnerability via File Manager (wp-file-manager) plugin in WordPress to upload and execute a PHP agent file to gain arbitrary code execution on the affected system.

This module uses an authenticated JNDI injection vulnerability via JndiBindingHandle class in Oracle Weblogic Server to upload and execute a java class file to gain arbitrary code execution on the affected system.

This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. The BIG-IP system in Appliance mode is also vulnerable.

Apache Unomi allows conditions to use OGNL and MVEL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.