CVE-2024-36401

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGrap

Github link:
https://github.com/thestar0/CVE-2024-36401-WoodpeckerPlugin

CVE-2024-47575

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.

Github link:
https://github.com/XiaomingX/cve-2024-47575-poc

CVE-2024-7965

Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Github link:
https://github.com/XiaomingX/cve-2024-7965-poc

CVE-2024-9441

The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary OS commands via the login_id parameter when invoking the forgot_password functionality over HTTP.

Github link:
https://github.com/XiaomingX/cve-2024-9441-poc

CVE-2023-32413

None

Github link:
https://github.com/synacktiv/CVE-2023-32413

CVE-2024-52429

None

Github link:
https://github.com/RandomRobbieBF/CVE-2024-52429

CVE-2024-52433

None

Github link:
https://github.com/RandomRobbieBF/CVE-2024-52433

CVE-2024-0012

None

Github link:
https://github.com/iSee857/CVE-2024-0012-poc

CVE-2024-5452

None

Github link:
https://github.com/XiaomingX/cve-2024-5452-poc

CVE-2024-45519

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

Github link:
https://github.com/XiaomingX/cve-2024-45519-poc

CVE-2024-23113

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Github link:
https://github.com/XiaomingX/cve-2024-23113-exp

CVE-2021-29442

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)

Github link:
https://github.com/XiaomingX/cve-2021-29442-Nacos-Derby-rce-exp

CVE-2024-52475

None

Github link:
https://github.com/ubaii/CVE-2024-52475

CVE-2024-48990

None

Github link:
https://github.com/felmoltor/CVE-2024-48990

CVE-2024-11381

None

Github link:
https://github.com/windz3r0day/CVE-2024-11381

CVE-2024-11428

None

Github link:
https://github.com/windz3r0day/CVE-2024-11428

CVE-2024-11412

None

Github link:
https://github.com/windz3r0day/CVE-2024-11412

CVE-2024-11388

None

Github link:
https://github.com/windz3r0day/CVE-2024-11388

CVE-2024-11432

None

Github link:
https://github.com/windz3r0day/CVE-2024-11432

CVE-2024-43919

None

Github link:
https://github.com/RandomRobbieBF/CVE-2024-43919