7-ZIP through version 21.07 allows privilege escalation and command execution when a file with .7z extension is dragged to the Help>Contents area. The vulnerability is being tracked as CVE-2022-29072. 7-Zip is a free and open-source file archiver for Windows, macOS, and Linux. The zero-day vulnerability in 7-zip is due to misconfiguration of 7z.dll … Continue reading “7-Zip Privilege Escalation and Command Execution Zero-day Vulnerability (CVE-2022-29072)”
Tag: command execution
rconfig unauthenticated remote code exection vulnerability
Summary: A command-execution vulnerability is observed in a free open-source configuration management well-known as rconfig. It fails to filter the ‘rootUname‘ parameter passed to the ‘exec()‘ function of the ‘ajaxServerSettingsChk.php‘ file. It can be exploited by sending a crafted GET request to execute system commands. Description: The vulnerabilities (CVE-2019-16663, CVE-2019-16662) are both tied to rConfig … Continue reading “rconfig unauthenticated remote code exection vulnerability”
Exim Remote Command Execution Vulnerability (CVE-2019-10149)
The Exim mail transfer agent (MTA) contains a vulnerability that can allow attackers to execute arbitrary commands reliably on a targeted system. This vulnerability was discovered by our own Qualys Security Research Team and has been named as “The Return of the WIZard” as a reference to a couple of similar command execution vulnerabilities in … Continue reading “Exim Remote Command Execution Vulnerability (CVE-2019-10149)”
Palo Alto Networks Expedition (Migration Tool) Unauthenticated Command Injection Vulnerability
A remote command injection vulnerability has been identified in Palo Alto Expedition (Migration Tool) . Expedition tool is used for moving firewall configurations from another vendor to Palo Alto’s product. It makes the conversion process easier to accomplish. MITRE has assigned CVE-2018-10143 for this vulnerability. Vulnerability Analysis: This vulnerability exists in convertCSVtoParquet.php which accepts user controlled input in a path … Continue reading “Palo Alto Networks Expedition (Migration Tool) Unauthenticated Command Injection Vulnerability”
Cortana Elevation of Privilege Vulnerability: CVE-2018-8140
An elevation of privilege vulnerability was discovered in Microsoft virtual assistant ‘Cortana’. The issue arises due to a behavior glitch in Cortana. Upon successful exploitation an attacker can gain elevated command execution. The attacker would need physical access to the target machine to perform the attack. Microsoft has addressed this vulnerability in patches released in … Continue reading “Cortana Elevation of Privilege Vulnerability: CVE-2018-8140”
