pizza-power

9 exploits Active since Jun 2016
CVE-2022-0824 NOMISEC HIGH WORKING POC
webmin < 1.990 - Improper Access Control to Remote Code Execution
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.
3 stars
CVSS 8.8
CVE-2021-22205 NOMISEC CRITICAL WORKING POC
GitLab 11.9.0-13.8.7 - Unauthenticated Remote Code Execution via ExifTool Image Parsing
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
3 stars
CVSS 10.0
CVE-2019-2729 NOMISEC CRITICAL WORKING POC
Oracle Communications Diameter Signaling Router - Unauthenticated Remote Code Execution via HTTP
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
3 stars
CVSS 9.8
CVE-2017-10271 NOMISEC HIGH WORKING POC
Oracle WebLogic wls-wsat Component Deserialization RCE
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
3 stars
CVSS 7.5
CVE-2023-3722 NOMISEC HIGH WORKING POC
Avaya Aura Device Services < 8.1.4.0 - Remote Code Execution via Malicious File Upload
An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.
2 stars
CVSS 8.6
CVE-2021-44077 NOMISEC CRITICAL WORKING POC
ManageEngine ServiceDesk Plus CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
2 stars
CVSS 9.8
CVE-2016-4437 NOMISEC CRITICAL WORKING POC
Apache Shiro < 1.2.5 - Remote Code Execution via Remember Me Feature
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
2 stars
CVSS 9.8
CVE-2024-32640 NOMISEC CRITICAL WORKING POC
MASA CMS <7.4.5-7.2.7 - SQL Injection
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
1 stars
CVSS 9.8
CVE-2021-44255 NOMISEC HIGH WORKING POC
MotionEye <= 0.42.1 and MotionEyeOS <= 20200606 - Authenticated Remote Code Execution via Malicious Configuration Backup
Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server.
1 stars
CVSS 7.2