Dhiraj Mishra

44 exploits Active since Jul 2017
CVE-2017-17692 NOMISEC HIGH WRITEUP
Samsung Internet Browser 5.4.02.3 - Same Origin Policy Bypass via JavaScript innerHTML Manipulation
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property.
CVSS 7.5
CVE-2020-37079 EXPLOITDB MEDIUM text WORKING POC
Wing FTP Server < 6.2.7 - Cross-Site Request Forgery in Web Administration Interface
Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administration interface that allows attackers to delete admin users. Attackers can craft a malicious HTML page with a hidden form to submit a request that deletes the administrative user account without proper authorization.
CVSS 4.3
CVE-2019-12477 METASPLOIT MEDIUM ruby WORKING POC
Supra Smart Cloud TV Remote File Inclusion
Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri&uri= URI.
CVSS 5.5
CVE-2018-11646 METASPLOIT HIGH ruby WORKING POC
WebKitGTK+ <2.21.3 - Use After Free
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.
CVSS 7.5
CVE-2017-1129 METASPLOIT MEDIUM ruby WORKING POC
IBM Notes 8.5 and 9.0 - Denial of Service via Malicious Link
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and have to be restarted. IBM X-Force ID: 121370.
CVSS 6.5
CVE-2017-1130 METASPLOIT MEDIUM ruby WORKING POC
IBM Notes 8.5-9.0 - Denial of Service via Malicious Link
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it would open up many file select dialog boxes which would cause the client hang and have to be restarted. IBM X-Force ID: 121371.
CVSS 6.5
CVE-2020-11491 METASPLOIT MEDIUM ruby WORKING POC
zen_load_balancer 3.10.1 - Authenticated Path Traversal via Monitoring Logs
Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated by a filelog=/etc/shadow request to index.cgi.
CVSS 4.9
CVE-2019-20085 METASPLOIT HIGH ruby WORKING POC
TVT NVMS-1000 Firmware - Path Traversal via GET Request
TVT NVMS-1000 devices allow GET /.. Directory Traversal
CVSS 7.5
CVE-2018-14912 METASPLOIT HIGH ruby WORKING POC
cgit < 1.2.1 - Path Traversal via git/objects/?path=../ Request
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
CVSS 7.5
CVE-2019-3799 METASPLOIT MEDIUM ruby WORKING POC
Spring Cloud Config < 1.4.6 - Path Traversal via Crafted URL
Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
CVSS 6.5
CVE-2021-42013 METASPLOIT CRITICAL ruby WORKING POC
Apache HTTP Server 2.4.49-2.4.50 - Path Traversal and Remote Code Execution via Alias-like Directives
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVSS 9.8
CVE-2020-5410 METASPLOIT HIGH ruby WORKING POC
Spring Cloud Config <2.2.3 & <2.1.9 - Path Traversal
Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
CVSS 7.5
CVE-2017-1000028 METASPLOIT HIGH ruby WORKING POC
Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
CVSS 7.5
CVE-2018-6849 METASPLOIT MEDIUM ruby WORKING POC
DuckDuckGo 4.2.0 - Private IP Address Exposure via WebRTC STUN Request
In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.
CVSS 4.3
CVE-2017-17692 METASPLOIT HIGH ruby WORKING POC
Samsung Internet Browser 5.4.02.3 - Same Origin Policy Bypass via JavaScript innerHTML Manipulation
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that redirects to a child tab and rewrites the innerHTML property.
CVSS 7.5
CVE-2021-42013 METASPLOIT CRITICAL ruby WORKING POC
Apache HTTP Server 2.4.49-2.4.50 - Path Traversal and Remote Code Execution via Alias-like Directives
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVSS 9.8
CVE-2018-8120 METASPLOIT HIGH ruby WORKING POC
Windows SetImeInfoEx Win32k NULL Pointer Dereference
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.
CVSS 7.0
CVE-2021-4034 METASPLOIT HIGH ruby WORKING POC
Local Privilege Escalation in polkits pkexec
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
CVSS 7.8
CVE-2017-1000028 EXPLOITDB HIGH ruby WORKING POC
Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
CVSS 7.5
CVE-2018-8120 EXPLOITDB HIGH ruby WORKING POC
Windows SetImeInfoEx Win32k NULL Pointer Dereference
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.
CVSS 7.0
CVE-2017-15084 EXPLOITDB MEDIUM text WRITEUP
Rapid7 Metasploit < 4.14.1 - Cross-Site Request Forgery via Logout Function
The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22.
CVSS 6.5
CVE-2018-6849 EXPLOITDB MEDIUM ruby WORKING POC
DuckDuckGo 4.2.0 - Private IP Address Exposure via WebRTC STUN Request
In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.
CVSS 4.3
CVE-2017-6328 EXPLOITDB HIGH text WRITEUP
Symantec Messaging Gateway < 10.6.3-267 - Cross-Site Request Forgery
The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.
CVSS 8.8
CVE-2019-19781 EXPLOITDB CRITICAL text SCANNER
Citrix ADC (NetScaler) Directory Traversal Scanner
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
CVSS 9.8
CVE-2017-1129 EXPLOITDB MEDIUM ruby WORKING POC
IBM Notes 8.5 and 9.0 - Denial of Service via Malicious Link
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and have to be restarted. IBM X-Force ID: 121370.
CVSS 6.5