RCE

Exploring Recent CVEs in HPE Insight Remote Support

D4mianwayne • • CVE Analysis • 10 min read
In this post, we’ll delve into two critical vulnerabilities recently discovered in the HPE Insight Remote Support (IRS) application, versions prior to v7.14.0.629. These vulnerabilities—CVE-2024-53675 (unauthenticated XXE vulnerability) and CVE-2024-53676 (Remote Code Execution, or RCE vulnerability)—pose significant security risks, allowing unauthorized access and arbitrary code execution on …
Read more…

CVE 2024-4040 - CrushFTP Server-Side Template Injection Vulnerability Analysis

D4mianwayne • • CVE Analysis • 23 min read
This blog post contains a thorough analysis of Server Side Template Injection vulnerability in a commercial Managed File Transfer product named CrushFTP. Exploit script is available here. CVE 2024-4040 - CrushFTP Server-Side Template Injection Vulnerability I am writing a blog post after a very long time. Finally the “hiatus” has ended and now I am back on track for analyzing real world …
Read more…