ArianeBlow

4 exploits Active since Feb 2021
CVE-2021-27513 NOMISEC HIGH WORKING POC
EyesOfNetwork 5.3-10 - Authenticated Unrestricted Upload of Dangerous File Type
The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le filtre userside."
CVSS 8.8
CVE-2021-27513 NOMISEC HIGH WORKING POC
EyesOfNetwork 5.3-10 - Authenticated Unrestricted Upload of Dangerous File Type
The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le filtre userside."
CVSS 8.8
CVE-2021-40345 NOMISEC HIGH WORKING POC
Nagios XI <5.8.5 - Command Injection
An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.
CVSS 7.2
CVE-2021-33525 WRITEUP HIGH WORKING POC
eyesofnetwork < 5.3-11 - Authenticated Remote Command Execution via Nagios Path Parameter
EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacharacters in the nagios_path parameter to lilac/export.php, as demonstrated by %26%26+curl to insert an "&& curl" substring for the shell.
CVSS 8.8