CVE-2024-0044

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.



Github link:
https://github.com/nexussecelite/EvilDroid

CVE-2021-41182

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

Github link:
https://github.com/aredspy/CVE-2021-41182-Tester

CVE-2019-16098

The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.

Github link:
https://github.com/Offensive-Panda/NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

CVE-2024-7339

None

Github link:
https://github.com/RevoltSecurities/CVE-2024-7339

CVE-2024-41958

None

Github link:
https://github.com/OrangeJuiceHU/CVE-2024-41958-PoC

CVE-2024-23897

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

Github link:
https://github.com/NoSpaceAvailable/CVE-2024-23897

CVE-2023-4596

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Github link:
https://github.com/X-Projetion/CVE-2023-4596-OpenSSH-Multi-Checker

CVE-2024-40422

None

Github link:
https://github.com/j3r1ch0123/CVE-2024-40422

CVE-2024-38100

None

Github link:
https://github.com/Florian-Hoth/CVE-2024-38100-RCE-POC

CVE-2024-37085

None

Github link:
https://github.com/Florian-Hoth/CVE-2024-37085-RCE-POC

CVE-2024-6222

None

Github link:
https://github.com/Florian-Hoth/CVE-2024-6222

CVE-2024-6782

None

Github link:
https://github.com/zangjiahe/CVE-2024-6782

CVE-2024-40080

None

Github link:
https://github.com/perras/CVE-2024-40080

CVE-2023-38831

RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through August 2023.

Github link:
https://github.com/yezzfusl/cve_2023_38831_scanner

CVE-2024-42461

None

Github link:
https://github.com/fevar54/CVE-2024-42461

CVE-2023-24249

None

Github link:
https://github.com/IDUZZEL/CVE-2023-24249-Exploit

CVE-2023-6444

None

Github link:
https://github.com/Wayne-Ker/CVE-2023-6444-POC

CVE-2024-32113

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

Users are recommended to upgrade to version 18.12.13, which fixes the issue.



Github link:
https://github.com/YongYe-Security/CVE-2024-32113

CVE-2024-38856

None

Github link:
https://github.com/securelayer7/CVE-2024-38856_Scanner

CVE-2024-34102

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/wubinworks/magento2-cosmic-sting-patch