Nomisec Exploits

23,022 exploits tracked across all sources.

Sort: Activity Stars
CVE-2017-8917 NOMISEC CRITICAL
Joomla! 3.7.x - SQL Injection
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.
by gmohlamo
CVSS 9.8
CVE-2021-21985 NOMISEC CRITICAL
VMware vCenter Server - Remote Code Execution via Virtual SAN Health Check Plugin
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
by bigbroke
1 stars
CVSS 9.8
CVE-2021-33564 NOMISEC CRITICAL
Dragonfly <1.4.0 - Command Injection
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
by mlr0p
16 stars
CVSS 9.8
CVE-2020-27955 NOMISEC CRITICAL
Git Remote Code Execution via git-lfs (CVE-2020-27955)
Git LFS 2.12.0 allows Remote Code Execution.
by Marsable
CVSS 9.8
CVE-2021-24027 NOMISEC HIGH
WhatsApp for Android <2.21.4.18 - Info Disclosure
A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.
by CENSUS
147 stars
CVSS 7.5
CVE-2020-6516 NOMISEC MEDIUM
Google Chrome <84.0.4147.89 - Auth Bypass
Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
by CENSUS
147 stars
CVSS 4.3
CVE-2021-33558 NOMISEC HIGH
Boa 0.94.13 - Information Disclosure via Misconfigured Backup Files
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not part of Boa.
by mdanzaruddin
3 stars
CVSS 7.5
CVE-2018-8174 NOMISEC HIGH
Windows VBScript Engine - Remote Code Execution via Memory Object Handling
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
by DarkFlameMaster-bit
CVSS 7.5
CVE-2021-3310 NOMISEC HIGH
Western Digital My Cloud OS < 5.10.122 - Symbolic Link Following via SMB and AFP Shares
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).
by piffd0s
1 stars
CVSS 7.8
CVE-2020-28948 NOMISEC HIGH
Archive_Tar < 1.4.11 - Deserialization of Untrusted Data via PHAR Case Bypass
Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
by nopdata
CVSS 7.8
CVE-2021-1905 NOMISEC HIGH
Qualcomm APQ8009 and related firmware - Use-After-Free in Memory Mapping
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
by TAKIANFIF
CVSS 8.4
CVE-2021-31166 NOMISEC CRITICAL
Windows IIS HTTP Protocol Stack DOS
HTTP Protocol Stack Remote Code Execution Vulnerability
by bgsilvait
CVSS 9.8
CVE-2021-29447 NOMISEC HIGH
WordPress 5.6.0-5.7.0 - Authenticated XML External Entity Injection via Media Library File Upload
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.
by Vulnmachines
4 stars
CVSS 7.1
CVE-2020-27955 NOMISEC CRITICAL
Git Remote Code Execution via git-lfs (CVE-2020-27955)
Git LFS 2.12.0 allows Remote Code Execution.
by nob0dy-3389
CVSS 9.8
CVE-2020-14372 NOMISEC HIGH
GRUB2 < 2.06 - Secure Boot Bypass via ACPI Table Injection
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.
by kukrimate
4 stars
CVSS 7.5
CVE-2021-28482 NOMISEC HIGH
Microsoft Exchange Server - Remote Code Execution
Microsoft Exchange Server Remote Code Execution Vulnerability
by KevinWorst
CVSS 8.8
CVE-2018-15961 NOMISEC CRITICAL
Adobe ColdFusion July 12 release (2018.0.0.310739) Update 6 and earlier Update 14 and earlier - Unrestricted File Upload
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
by bu1xuan2
CVSS 9.8
CVE-2017-6558 NOMISEC CRITICAL
iball iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n - Authentication Bypass via Password CGI HTML Source
iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote attackers to view and modify administrative router settings by reading the HTML source code of the password.cgi file.
by GemGeorge
5 stars
CVSS 9.8
CVE-2019-6260 NOMISEC CRITICAL
ASPEED ast2400/2500 - Info Disclosure
The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC's physical address space from the host (or from the network in unusual cases where the BMC console uart is attached to a serial concentrator). This CVE applies to the specific cases of iLPC2AHB bridge Pt I, iLPC2AHB bridge Pt II, PCIe VGA P2A bridge, DMA from/to arbitrary BMC memory via X-DMA, UART-based SoC Debug interface, LPC2AHB bridge, PCIe BMC P2A bridge, and Watchdog setup.
by nikitapbst
5 stars
CVSS 9.8
CVE-2021-21551 NOMISEC HIGH
Dell DBUtil < 2.3 - Authenticated Insufficient Access Control in IOCTL Handler
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
by ch3rn0byl
25 stars
CVSS 8.8
CVE-2021-22204 NOMISEC MEDIUM
GitLab Unauthenticated Remote ExifTool Command Injection
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
by bilkoh
8 stars
CVSS 6.8
CVE-2021-22204 NOMISEC MEDIUM
GitLab Unauthenticated Remote ExifTool Command Injection
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
by convisolabs
94 stars
CVSS 6.8
CVE-2021-21551 NOMISEC HIGH
Dell DBUtil < 2.3 - Authenticated Insufficient Access Control in IOCTL Handler
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
by waldo-irc
235 stars
CVSS 8.8
CVE-2019-13272 NOMISEC HIGH
Linux Polkit pkexec helper PTRACE_TRACEME local root exploit
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
by jana30116
CVSS 7.8
CVE-2019-7238 NOMISEC CRITICAL
Sonatype Nexus Repository Manager <3.15.0 - Privilege Escalation
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
by smallpiggy
1 stars
CVSS 9.8