CVE-2024-28995













SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.









Github link:
https://github.com/gotr00t0day/CVE-2024-28995

CVE-2023-4220

Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.

Github link:
https://github.com/thefizzyfish/CVE-2023-4220

CVE-2024-38063

None

Github link:
https://github.com/haroonawanofficial/CVE-2024-38063-Research-Tool

CVE-2023-50564

None

Github link:
https://github.com/thefizzyfish/CVE-2023-50564-pluck

CVE-2024-38063

None

Github link:
https://github.com/ynwarcs/CVE-2024-38063

CVE-2024-44083

None

Github link:
https://github.com/Azvanzed/CVE-2024-44083

CVE-2024-5932

None

Github link:
https://github.com/EQSTSeminar/CVE-2024-5932

CVE-2024-28000

None

Github link:
https://github.com/ebrasha/CVE-2024-28000

CVE-2024-45241

None

Github link:
https://github.com/d4lyw/CVE-2024-45241

CVE-2024-30088

Windows Kernel Elevation of Privilege Vulnerability

Github link:
https://github.com/Justintroup85/exploits-forsale-collateral-damage

CVE-2024-2887

None

Github link:
https://github.com/rycbar77/CVE-2024-2887

CVE-2024-1939

None

Github link:
https://github.com/rycbar77/CVE-2024-1939

CVE-2022-35914

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Github link:
https://github.com/noxlumens/CVE-2022-35914_poc

CVE-2024-41312

None

Github link:
https://github.com/Amal264882/CVE-2024-41312.

CVE-2023-22809

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

Github link:
https://github.com/laxmiyamkolu/SUDO-privilege-escalation

CVE-2024-45265

None

Github link:
https://github.com/TheHermione/CVE-2024-45265

CVE-2024-45264

None

Github link:
https://github.com/TheHermione/CVE-2024-45264

CVE-2021-41773

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Github link:
https://github.com/0xc4t/CVE-2021-41773

CVE-2024-6386

None

Github link:
https://github.com/realbotnet/CVE-2024-6386

CVE-2024-4879

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Github link:
https://github.com/fa-rrel/CVE-2024-4879