kernel-cyber

3 exploits Active since Jul 2006
CVE-2009-4623 NOMISEC WORKING POC
Advanced Comment System 1.0 - Remote Code Execution via ACS_path Parameter
Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACS_path parameter to (1) index.php and (2) admin.php in advanced_comment_system/. NOTE: this might only be a vulnerability when the administrator has not followed installation instructions in install.php. NOTE: this might be the same as CVE-2020-35598.
1 stars
CVE-2021-42913 NOMISEC HIGH WORKING POC
Samsung SyncThru Web Service - Unauthenticated Cleartext Password Exposure via HTML Source Code
The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by reading the HTML source code. Authentication is not required.
CVSS 7.5
CVE-2006-3392 NOMISEC WORKING POC
Usermin < 1.220 - Arbitrary File Read via Path Traversal with URL-Encoded Bypass
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.