This exploit allows an attacker to execute remote code on the Linear eMerge E3 version 1.00-06. It is achieved through an unauthenticated command injection vulnerability in the card_scan_decoder.php file. The vulnerability is identified by the CVE-2019-7256 identifier. The exploit provides an example of obtaining web front-end credentials and escalating privileges to root. The affected version is <=1.00-06.
The Wondershare Application Framework Service (WsAppService) on Windows has an unquoted service path vulnerability. This vulnerability could allow an attacker to escalate privileges and execute arbitrary code with system level privileges.
There is a stack based buffer overflow vulnerability in Control Center PRO 6.2.9. When attempting to use the create user module, in the username field, copying a considerable amount of strings is not controlled by the software and leads to an overwrite of the SEH.
The RTK IIS Codec Service 6.4.10041.133 allows an attacker to execute arbitrary code by exploiting the unquoted service path vulnerability.
The Optergy 2.3.0a version of the product allows an attacker to disclose the usernames of the system. By sending a specially crafted request to the Login.html page, the attacker can retrieve a list of usernames.
The vulnerability exists in the frontpage_right.php file of Arcadem LE version 2.04. An attacker can exploit this vulnerability by injecting a file through the 'loadadminpage' parameter in the URL.
The Alps Pointing-device controller installs a service with an unquoted path which could be used as a local privilege escalation vulnerability. To exploit this vulnerability, an executable file could be placed in the path of the service and after rebooting the system or restarting the service the malicious code will be executed with elevated privileges.
This module allows an attacker to perform directory traversal attacks on Atlassian Confluence version 6.15.1. By exploiting this vulnerability, an attacker can write arbitrary files to the server.
This exploit allows an attacker to upload arbitrary files to the Prima Access Control software version 2.3.35. By sending a specially crafted POST request to the sysfcgi.fx endpoint, an attacker can upload a malicious Python script that can execute arbitrary commands on the target system.
This exploit allows an attacker to perform a persistent cross-site scripting attack in the 'HwName' parameter of the Prima Access Control software version 2.3.35. By injecting malicious script code, an attacker can execute arbitrary JavaScript code in the context of the victim's browser.
Services By CQR
