what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 3 of 3

Files from Johannes Moritz

ManageEngine OpManager SumPDU Java Deserialization

Posted Sep 21, 2021

Authored by Spencer McIntyre, Robin Peraglie, Johannes Moritz | Site metasploit.com

An HTTP endpoint used by the Manage Engine OpManager Smart Update Manager component can be leveraged to deserialize an arbitrary Java object. This can be abused by an unauthenticated remote attacker to execute OS commands in the context of the OpManager application. This vulnerability is also present in other products that are built on top of the OpManager application. This vulnerability affects OpManager versions 12.1 through 12.5.328.

tags | exploit, java, remote, web, arbitrary

advisories | CVE-2020-28653, CVE-2021-3287

SHA-256 | a64897f563277f473cabf805ba128ebed5a9f941959e6b9130ab7f541f5a6e50

Download | Favorite | View

OX App Suite / OX Documents 7.10.3 XSS / SSRF / Improper Validation

Posted Jun 12, 2020

Authored by Martin Heiland, Johannes Moritz, zee_shan, chbi, Hasan Ali

OX App Suite and OX Documents versions 7.10.3 and below suffer from server-side request forgery, cross site scripting, improper parameter validation, and XML injection vulnerabilities.

tags | exploit, vulnerability, xss

advisories | CVE-2019-18846, CVE-2020-8541, CVE-2020-8542, CVE-2020-8543, CVE-2020-8544

SHA-256 | 64ac41f600218c8a53f85f7edaf868fd9208d415671cac26f51f2f16940095bb

Download | Favorite | View

Moodle 3.x PHP Unserialize Remote Code Execution

Posted Sep 19, 2018

Authored by Johannes Moritz | Site sec-consult.com

Moodle versions 3.5.2, 3.4.5, 3.3.8, and 3.1.14 suffer from a remote php unserialize code execution vulnerability.

tags | exploit, remote, php, code execution

advisories | CVE-2018-14630

SHA-256 | e1192dea24bdf40a1f2a57e173fb3e080e8f325080cbf19e225ef91eda41a138

Download | Favorite | View