what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 2 of 2

Files from Robin Peraglie

ManageEngine OpManager SumPDU Java Deserialization

Posted Sep 21, 2021

Authored by Spencer McIntyre, Robin Peraglie, Johannes Moritz | Site metasploit.com

An HTTP endpoint used by the Manage Engine OpManager Smart Update Manager component can be leveraged to deserialize an arbitrary Java object. This can be abused by an unauthenticated remote attacker to execute OS commands in the context of the OpManager application. This vulnerability is also present in other products that are built on top of the OpManager application. This vulnerability affects OpManager versions 12.1 through 12.5.328.

tags | exploit, java, remote, web, arbitrary

advisories | CVE-2020-28653, CVE-2021-3287

SHA-256 | a64897f563277f473cabf805ba128ebed5a9f941959e6b9130ab7f541f5a6e50

Download | Favorite | View

Roundcube 1.2.2 Command Execution

Posted Dec 9, 2016

Authored by Robin Peraglie

Roundcube version 1.2.2 suffers from a command execution vulnerability via email.

tags | exploit

SHA-256 | c33ac8a7ad33eb2dedca6d6c33967345233c61a99ebffb04c4373835fe6c8ff6

Download | Favorite | View