CVE-2023-38831

RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through August 2023.

Github link:
https://github.com/FirFirdaus/CVE-2023-38831

CVE-2024-0195

A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.

Github link:
https://github.com/fa-rrel/CVE-2024-0195-SpiderFlow

CVE-2023-29360

Microsoft Streaming Service Elevation of Privilege Vulnerability

Github link:
https://github.com/0xDivyanshu-new/CVE-2023-29360-

CVE-2024-24919

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

Github link:
https://github.com/AhmedMansour93/Event-ID-263-Rule-Name-SOC287---Arbitrary-File-Read-on-Checkpoint-Security-Gateway-CVE-2024-24919-

CVE-2024-44812

None

Github link:
https://github.com/b1u3st0rm/CVE-2024-44812-PoC

CVE-2024-38063

None

Github link:
https://github.com/ThemeHackers/CVE-2024-38063

CVE-2024-21413

Microsoft Outlook Remote Code Execution Vulnerability

Github link:
https://github.com/ThemeHackers/CVE-2024-21413

CVE-2024-38080

None

Github link:
https://github.com/pwndorei/CVE-2024-38080

CVE-2024-7954

None

Github link:
https://github.com/fa-rrel/CVE-2024-7954-RCE

CVE-2024-38063

None

Github link:
https://github.com/KernelKraze/CVE-2024-38063_PoC

CVE-2020-24972

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Github link:
https://github.com/SpiralBL0CK/CVE-2020-24972

CVE-2024-7029

None

Github link:
https://github.com/ebrasha/CVE-2024-7029

CVE-2023-45866

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Github link:
https://github.com/AvishekDhakal/CVE-2023-45866_EXPLOITS

CVE-2023-42115

Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-17434.

Github link:
https://github.com/isotaka134/cve-2023-42115

CVE-2022-44268

ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).

Github link:
https://github.com/FlojBoj/CVE-2022-44268

CVE-2024-5420

None

Github link:
https://github.com/fa-rrel/CVE-2024-5420-XSS

CVE-2023-26136

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Github link:
https://github.com/m-lito13/SealSecurity_Exam

CVE-2024-45589

None

Github link:
https://github.com/BenRogozinski/CVE-2024-45589

CVE-2023-4220

Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.

Github link:
https://github.com/0x00-null/-Chamilo-CVE-2023-4220-RCE-Exploit

CVE-2024-24809

None

Github link:
https://github.com/fa-rrel/CVE-2024-24809-Proof-of-concept

CVE-2023-26360

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Github link:
https://github.com/CuriousLearnerDev/ColdFusion_EXp