h00die vulnerabilities and exploits

(subscribe to this query)

NA

Multiple buffer overflows in the FTP server on the Addonics NAS Adapter NASU2FW41 with loader 1.17 allow remote malicious users to cause a denial of service (TCP/IP outage) via long arguments to the (1) XRMD, (2) delete, (3) RNFR, or (4) RNTO command.

Nas Adapter Nasu2fw41 1.17 Nas Adapter Nasu2fw41

1 EDB exploit

7.5

CVSSv3

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenti...

Igniterealtime Openfire

13 Github repositories3 Articles

9.8

CVSSv3

There is a command injection vulnerability in SolarView Compact up to and including 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.

Contec Solarview Compact Firmware

4 Github repositories

8.6

CVSSv3

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and previous versions, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working director...

Linuxfoundation Runc Fedoraproject Fedora 39

21 Github repositories

7.8

CVSSv3

Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local malicious users to execute arbitrary code v...

Gl-inet Gl-mt1300 Firmware 4.3.7 Gl-inet Gl-mt300n-v2 Firmware 4.3.7 Gl-inet Gl-ar750s Firmware 4.3.7 Gl-inet Gl-ar750 Firmware 4.3.7 Gl-inet Gl-ar300m Firmware 4.3.7 Gl-inet Gl-b1300 Firmware 4.3.7 Gl-inet Gl-mt6000 Firmware 4.5.0 Gl-inet Gl-a1300 Firmware 4.4.6 Gl-inet Gl-ax1800 Firmware 4.4.6 Gl-inet Gl-axt1800 Firmware 4.4.6 Gl-inet Gl-mt3000 Firmware 4.4.6 Gl-inet Gl-mt2500 Firmware 4.4.6

7.2

CVSSv3

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated malicious user to execute arbitrary Python code.

Plex Media Server

NA

This Metasploit module is a Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected.

9.8

CVSSv3

TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an malicious user to execute arbitrary commands through the "command" parameter.

Totolink X5000r Firmware 9.1.0u.6118 B20201102 Totolink X5000r Firmware 9.1.0u.6369 B20230113

9.8

CVSSv3

The drag-and-drop-multiple-file-upload-contact-form-7 plugin prior to 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.

Codedropz Drag And Drop Multiple File Upload - Contact Form 7

2 Github repositories

9.8

CVSSv3

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote malicious users to run arbitrary commands via unauthenticated HTTP request.

Magnussolution Magnusbilling

2 Github repositories

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook