CVE-2024-7965 affects the V8 JavaScript engine used in Google Chrome. This zero-day vulnerability stems from a flawed implementation that allows attackers to exploit heap corruption through specially crafted HTML pages. With a CVSS score of 8.8, it poses a serious threat to the confidentiality and integrity of affected systems. First discovered by the security researcher known as
Loading
Prapattimynk
An attacker with authenticated access to VICIdial as an “agent” can execute arbitrary shell commands as the “root” user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective. This repository contains a combined exploit for two critical vulnerabilities discovered in VICIdial by KoreLogic: These vulnerabilities allow an attacker to retrieve
459Examine the Potential of Remote Administration. Remote Support. Remote Monitoring. Penetration Testing. PASSWORD: ONIMAI FUCKERS FUCKING ONIMAIOffensive Remote Administration & Pentesting ToolFeatures:
CVE-2024-44000 is a vulnerability in the LiteSpeed Cache plugin, a popular WordPress plugin. This vulnerability affects session management in LiteSpeed Cache, allowing attackers to gain unauthorized access to sensitive data.The script works in the following steps: If the response includes a 302 Redirect with a Location header containing the wp-admin path, it considers the hijacking successful. The script generates URLs with
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data. Potential impact : Exploitation of CVE-2024-28987 could allow an attacker to bypass security policies implemented in SolarWinds Web Help Desk, which could result in unauthorized access to sensitive data, modification
Discovered and reported a vulnerability in wappd, a network daemon that is a part of the MediaTek MT7622/MT7915 SDK and RTxxxx SoftAP driver bundle. This chipset is commonly used on embedded platforms that support Wifi6 (802.11ax) including Ubiquiti, Xiaomi, and Netgear devices. As is the case for a handful of other bugs I’ve found, I originally
CVE-2024-7029 highlights a severe security issue in AVTech devices, where attackers can bypass authentication and execute arbitrary commands remotely. This vulnerability poses significant risks to the integrity and security of affected networks. 💀 Vulnerability OverviewCVE-2024-7029 is a critical security flaw in AVTech devices that allows unauthorized access through authentication bypass, potentially leading to remote code
489📱 Compatible with all devices🔓 Bypass Play Store Signature📦 The bypass does not depend on APK files outside the Play Store🛡 100% FUD APK file💸 Money back guarantee if the bypass doesn’t work🔒 No screen permissions required🚫 No permission requests when installing APKs on your device
Fully automated exploit for CVE-2024-25641. When a user is authenticated, Cacti version 1.2.26 is vulnerable to an arbitrary file write vulnerability, exploitable through the “Package Import” feature, allows authenticated users having the “Import Templates” permission to execute arbitrary PHP code on the web server (RCE). Cacti provides an operational monitoring and fault management framework. Prior
poc for CVE-2024-38063, a RCE in tcpip.sys patched on August 13th 2024. usage Modify the fields in the script: Run the script: The easiest way to reproduce the vuln is by using bcdedit /set debug on and restarting the machine/VM. This makes the default network adapter driver kdnic.sys, which is very happy to coalesce packets. If you’re trying to
183XSSLite is an information stealer. It was developed as part of a monetary prize-driven competition held on a Russian hacker forum. There are several variants of this malware; the original version written in the C# programming language was made available for free by the developers, while another variant was created by rewriting the stealer in C++. XSSLite was
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1. The LiteSpeed Cache plugin’s user simulation feature is protected by a weak security hash generated using predictable values. An attacker can exploit this vulnerability by brute-forcing the security hash and passing it in a
A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-38793-PoC Proof of Concept code for exploitation of CVE-2024-38793 (Best Restaurant Menu by PriceListo <= 1.4.1 – Authenticated (Contributor+) SQL Injection). This is a proof of concept exploit for the vulnerability CVE-2024-38793, an SQL injection vulnerability for versions of the WordPress plugin Best Restaurant Menu a.k.a Great Restaurant Menu WP before 1.4.2. The vulnerability occurs because of a
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. This repository
A new Edge stealer v4.0 incorporates with various functionalities, it’s private stub, developed from scratch in C/Golang,. These include capturing screenshots of the desktop, stealing wallets from platforms like Atomic, Exodus, and MetaMask, extracting passwords from all major browsers, acquiring cookies from Chrome and Firefox, gathering browser history and downloaded files, retrieving Task Scheduler lists,
A PoC Exploit for CVE-2024-3105 – The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress Remote Code Execution (RCE) The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the ‘insert_php’
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don’t explicitly check user’s permissions because they rely
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability Affected versions from Win server 2000 to Win server 2025 A hole in the Windows Remote Desktop Licensing (RDL) service, 170,000 such hosts are currently exposed on the Internet.Patched in July PoC exploit released for critical 0-click remote code execution (RCE) vulnerability affecting Windows Server. This
A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
591 Articles Published
