Spencer McIntyre

128 exploits Active since Mar 1998
CVE-2023-48788 METASPLOIT CRITICAL ruby WORKING POC
Fortinet Forticlient Endpoint Management Server - SQL Injection
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
CVSS 9.8
CVE-2021-31181 METASPLOIT HIGH ruby WORKING POC
Microsoft Sharepoint Enterprise Server - Code Injection
Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 8.8
CVE-2022-41082 METASPLOIT HIGH ruby WORKING POC
Microsoft Exchange Server - RCE
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS 8.0
CVE-2020-1147 METASPLOIT HIGH ruby WORKING POC
Microsoft .net Core < 15.9 - Remote Code Execution
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
CVSS 7.8
CVE-2020-0646 METASPLOIT CRITICAL ruby WORKING POC
Microsoft .net Framework - Remote Code Execution
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
CVSS 9.8
CVE-2017-11317 METASPLOIT CRITICAL ruby WORKING POC
Telerik UI For Asp.net Ajax < 2016.3.1027 - Weak Encryption
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVSS 9.8
CVE-2024-1800 METASPLOIT CRITICAL ruby WORKING POC
Progress Telerik Report Server - Insecure Deserialization
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.
CVSS 9.9
CVE-2020-17132 METASPLOIT CRITICAL ruby WORKING POC
Microsoft Exchange - RCE
Microsoft Exchange Remote Code Execution Vulnerability
CVSS 9.1
CVE-2020-13166 METASPLOIT CRITICAL ruby WORKING POC
MyLittleAdmin 3.8 - RCE
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.
CVSS 9.8
CVE-2021-34523 METASPLOIT CRITICAL ruby WORKING POC
Microsoft Exchange Server - Privilege Escalation
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS 9.0
CVE-2021-22652 METASPLOIT CRITICAL ruby WORKING POC
Advantech iView <5.7.03.6112 - Code Execution
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.
CVSS 9.8
CVE-2020-0618 METASPLOIT HIGH ruby WORKING POC
Microsoft Sql Server - Insecure Deserialization
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
CVSS 8.8
CVE-2022-38108 METASPLOIT HIGH ruby WORKING POC
SolarWinds Platform - Code Injection
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVSS 7.2
CVE-2013-2492 METASPLOIT ruby WORKING POC
Firebird <2.1.5-2.5.3 - Buffer Overflow
Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number from CNCT information.
CVE-2013-3563 METASPLOIT ruby WORKING POC
Lianja Sql Server < 1.0 - Memory Corruption
Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string to TCP port 8001.
CVE-2023-28324 METASPLOIT CRITICAL ruby WORKING POC
Ivanti Endpoint Manager < 2022 - Improper Input Validation
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution.
CVSS 9.8
CVE-2014-6271 METASPLOIT CRITICAL ruby WORKING POC
Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
CVSS 9.8
CVE-1999-0502 METASPLOIT ruby WORKING POC
Unix - Info Disclosure
A Unix account has a default, null, blank, or missing password.
CVE-2023-22527 METASPLOIT CRITICAL ruby WORKING POC
Atlassian Confluence SSTI Injection
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.
CVSS 9.8
CVE-2024-2044 METASPLOIT CRITICAL ruby WORKING POC
pgAdmin <= 8.3 - Path Traversal
pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.
CVSS 9.9
CVE-2014-4971 METASPLOIT ruby WORKING POC
Microsoft Windows XP SP3 - Privilege Escalation
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ Access Control subsystem and (2) the BthPan.sys driver in the Bluetooth Personal Area Networking subsystem.
CVE-2022-23277 METASPLOIT HIGH ruby WORKING POC
Microsoft Exchange Server ChainedSerializationBinder RCE
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS 8.8
CVE-2020-0688 METASPLOIT HIGH ruby WORKING POC
Microsoft Exchange Server - Authentication Bypass
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
CVSS 8.8
CVE-2020-0796 METASPLOIT CRITICAL ruby WORKING POC
Microsoft Windows 10 1903 - Memory Corruption
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
CVSS 10.0
CVE-2008-4037 METASPLOIT ruby WORKING POC
Microsoft Windows <2008 - RCE
Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability." NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.