The Qualys Threat Research Unit has discovered a Remote Unauthenticated Code Execution vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. CVE assigned to this vulnerability is CVE-2024-6387.
The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems.
🔗 Research:
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
🔗 PoC:
https://github.com/acrono/cve-2024-6387-poc
#openssh #glibc #rce #cve
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥22❤1👍1
VMware vCenter - CVE-2024-22274.pdf
1.1 MB
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to run arbitrary commands on the underlying operating system as the "root" user.
🔗 Source:
https://github.com/mbadanoiu/CVE-2024-22274
https://github.com/l0n3m4n/CVE-2024-22274-RCE
#vmware #vcenter #rce #cve
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥9👍3❤2
This media is not supported in your browser
VIEW IN TELEGRAM
PoC for:
— CVE-2024-38094
— CVE-2024-38024
— CVE-2024-38023
🔗 Source:
https://github.com/testanull/MS-SharePoint-July-Patch-RCE-PoC
#sharepoint #poc #rce #cve
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥9👍4
🔍 Deep Dive into Windows IPv6 TCP/IP
An overview of CVE-2024-38063, a remote code execution vulnerability in Windows IPv6 TCP/IP. Includes a technical summary, PoC instructions and a reproduction guide.
🔗 Research:
https://malwaretech.com/2024/08/exploiting-CVE-2024-38063.html
🔗 PoC:
https://github.com/ynwarcs/CVE-2024-38063
#windows #kernel #ipv6 #rce #poc
An overview of CVE-2024-38063, a remote code execution vulnerability in Windows IPv6 TCP/IP. Includes a technical summary, PoC instructions and a reproduction guide.
🔗 Research:
https://malwaretech.com/2024/08/exploiting-CVE-2024-38063.html
🔗 PoC:
https://github.com/ynwarcs/CVE-2024-38063
#windows #kernel #ipv6 #rce #poc
Malwaretech
CVE-2024-38063 - Remotely Exploiting The Kernel Via IPv6
Performing a root cause analysis & building proof-of-concept for CVE-2024-38063, a CVSS 9.8 Vulnerability In the Windows Kernel IPv6 Parser
🔥8👍3❤1
Nagios XI 2024R1.01 has a vulnerability in the
monitoringwizard.php component, allowing authenticated SQL injection (CVE-2024-24401) that lets attackers create an admin account and remote code execution. 🔗 Source:
https://github.com/MAWK0235/CVE-2024-24401
#nagios #sql #rce #privesc #poc #exploit
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥12👍2
A critical deserialization vulnerability in .NET Remoting has been discovered in Veeam Backup & Replication, allowing unauthenticated remote code execution (RCE). The flaw affects versions
12.1.2.172 and earlier.🔗 Research:
https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/
🔗 Source:
https://github.com/watchtowrlabs/CVE-2024-40711
#veeam #backup #deserialization #unauth #rce
Please open Telegram to view this post
VIEW IN TELEGRAM
watchTowr Labs
Veeam Backup & Response - RCE With Auth, But Mostly Without Auth (CVE-2024-40711)
Every sysadmin is familiar with Veeam’s enterprise-oriented backup solution, ‘Veeam Backup & Replication’. Unfortunately, so is every ransomware operator, given it's somewhat 'privileged position' in the storage world of most enterprise's networks. There's…
👍5🔥5😁1
⚙️ Citrix Virtual Apps and Desktops — Unauthenticated RCE
This vulnerability in Citrix Virtual Apps and Desktops enables unauthorized users to achieve remote code execution through a misconfigured Microsoft Message Queuing (MSMQ) service accessible over HTTP. The issue stems from using an outdated BinaryFormatter for data deserialization, allowing attackers to run commands with SYSTEM privileges on the Citrix server.
🔗 Research:
https://labs.watchtowr.com/visionaries-at-citrix-have-democratised-remote-network-access-citrix-virtual-apps-and-desktops-cve-unknown/
🔗 Source:
https://github.com/watchtowrlabs/Citrix-Virtual-Apps-XEN-Exploit
#citrix #msmq #deserialization #unauth #rce
This vulnerability in Citrix Virtual Apps and Desktops enables unauthorized users to achieve remote code execution through a misconfigured Microsoft Message Queuing (MSMQ) service accessible over HTTP. The issue stems from using an outdated BinaryFormatter for data deserialization, allowing attackers to run commands with SYSTEM privileges on the Citrix server.
🔗 Research:
https://labs.watchtowr.com/visionaries-at-citrix-have-democratised-remote-network-access-citrix-virtual-apps-and-desktops-cve-unknown/
🔗 Source:
https://github.com/watchtowrlabs/Citrix-Virtual-Apps-XEN-Exploit
#citrix #msmq #deserialization #unauth #rce
watchTowr Labs
Visionaries Have Democratised Remote Network Access - Citrix Virtual Apps and Desktops (CVE-2024-8068 and CVE-2024-8069)
Well, we’re back again, with yet another fresh-off-the-press bug chain (and associated Interactive Artifact Generator). This time, it’s in Citrix’s “Virtual Apps and Desktops” offering.
This is a tech stack that enables end-users (and likely, your friendly…
This is a tech stack that enables end-users (and likely, your friendly…
👍4❤3😱2👎1🔥1
🚨 Fortinet FortiManager Unauthenticated RCE (CVE-2024-47575)
The remote code execution vulnerability in FortiManager allows attackers to perform arbitrary operations by exploiting commands via the FGFM protocol, circumventing authentication. Referred to as FortiJump, this vulnerability provides unauthorized access to FortiManager, enabling control over FortiGate devices by taking advantage of insufficient security in command handling and device registration processes.
🛠 Affected Versions:
🔗 Research:
https://labs.watchtowr.com/hop-skip-fortijump-fortijumphigher-cve-2024-23113-cve-2024-47575/
🔗 Source:
https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
#fortinet #fortimanager #fgfm #unauth #rce
The remote code execution vulnerability in FortiManager allows attackers to perform arbitrary operations by exploiting commands via the FGFM protocol, circumventing authentication. Referred to as FortiJump, this vulnerability provides unauthorized access to FortiManager, enabling control over FortiGate devices by taking advantage of insufficient security in command handling and device registration processes.
🛠 Affected Versions:
FortiManager 7.6.0
FortiManager 7.4.0 through 7.4.4
FortiManager 7.2.0 through 7.2.7
FortiManager 7.0.0 through 7.0.12
FortiManager 6.4.0 through 6.4.14
FortiManager 6.2.0 through 6.2.12
FortiManager Cloud 7.4.1 through 7.4.4
FortiManager Cloud 7.2.1 through 7.2.7
FortiManager Cloud 7.0.1 through 7.0.12
FortiManager Cloud 6.4
🔗 Research:
https://labs.watchtowr.com/hop-skip-fortijump-fortijumphigher-cve-2024-23113-cve-2024-47575/
🔗 Source:
https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575
#fortinet #fortimanager #fgfm #unauth #rce
👍9🔥9🎉6❤4😁1
A critical vulnerability chain in Palo Alto PAN-OS, combining an authentication bypass (CVE-2024-0012) and a command injection flaw (CVE-2024-9474) in the management web interface, allows unauthenticated attackers to execute arbitrary code with root privileges.
🛠 Affected Versions:
— PAN-OS 11.2 (up to and including 11.2.4-h1)
— PAN-OS 11.1 (up to and including 11.1.5-h1)
— PAN-OS 11.0 (up to and including 11.0.6-h1)
— PAN-OS 10.2 (up to and including 10.2.12-h2)
🔗 Research:
https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/
🔗 PoC:
https://github.com/watchtowrlabs/palo-alto-panos-cve-2024-0012
🔗 Exploit:
https://github.com/Chocapikk/CVE-2024-9474
#paloalto #panos #sslvpn #unauth #rce
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥8👍7
Forwarded from Ralf Hacker Channel (Ralf Hacker)
CVE-2024-43468: ConfigMgr/SCCM 2403 Unauth SQLi to RCE
PATCHED: Oct 8, 2024
Exploit: https://github.com/synacktiv/CVE-2024-43468
Blog: https://www.synacktiv.com/advisories/microsoft-configuration-manager-configmgr-2403-unauthenticated-sql-injections
#git #exploit #ad #rce #sccm #pentest #redteam
PATCHED: Oct 8, 2024
Exploit: https://github.com/synacktiv/CVE-2024-43468
Blog: https://www.synacktiv.com/advisories/microsoft-configuration-manager-configmgr-2403-unauthenticated-sql-injections
#git #exploit #ad #rce #sccm #pentest #redteam
GitHub
GitHub - synacktiv/CVE-2024-43468
Contribute to synacktiv/CVE-2024-43468 development by creating an account on GitHub.
🔥5👍2❤1
⚙️ Wazuh — Unsafe Deserialization RCE (CVE-2025-24016)
An unsafe deserialization vulnerability in Wazuh servers allows remote code execution through unsanitized dictionary injection in DAPI requests/responses. If an attacker injects an unsanitized dictionary into a DAPI request or response, they can craft an unhandled exception, allowing arbitrary Python code execution.
🔗 Source:
https://github.com/0xjessie21/CVE-2025-24016
#wazuh #deserialization #rce #cve
An unsafe deserialization vulnerability in Wazuh servers allows remote code execution through unsanitized dictionary injection in DAPI requests/responses. If an attacker injects an unsanitized dictionary into a DAPI request or response, they can craft an unhandled exception, allowing arbitrary Python code execution.
🔗 Source:
https://github.com/0xjessie21/CVE-2025-24016
#wazuh #deserialization #rce #cve
1🔥15❤5👍3
Critical deserialization of untrusted data vulnerability in Microsoft SharePoint allows unauthenticated remote code execution over the network. The exploit uses POST requests to
/_layouts/15/ToolPane.aspx with HTTP Referer header /_layouts/SignOut.aspx to bypass authentication, then extracts MachineKey configuration to generate valid __VIEWSTATE payloads for arbitrary code execution via a single HTTP request.🔗 Research:
https://research.eye.security/sharepoint-under-siege/
🔗 PoC:
https://gist.github.com/gboddin/6374c04f84b58cef050f5f4ecf43d501
🔗 Exploit:
https://github.com/soltanali0/CVE-2025-53770-Exploit
#ad #sharepoint #deserialization #toolshell #rce
Please open Telegram to view this post
VIEW IN TELEGRAM
❤14🔥13👍4