Vulnerabilities > Rapid7 > Metasploit > 4.13.19
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-04-23 | CVE-2020-7385 | Deserialization of Untrusted Data vulnerability in Rapid7 Metasploit By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. | 8.8 |
| 2020-10-29 | CVE-2020-7384 | Command Injection vulnerability in Rapid7 Metasploit Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine. | 7.8 |
| 2020-09-01 | CVE-2019-5645 | Resource Exhaustion vulnerability in Rapid7 Metasploit By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. | 7.5 |
| 2020-08-24 | CVE-2020-7377 | Path Traversal vulnerability in Rapid7 Metasploit The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server. | 7.5 |
| 2020-08-24 | CVE-2020-7376 | Path Traversal vulnerability in Rapid7 Metasploit The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host. | 9.8 |
| 2020-04-22 | CVE-2020-7350 | OS Command Injection vulnerability in Rapid7 Metasploit Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. | 7.8 |
| 2019-04-30 | CVE-2019-5624 | Path Traversal vulnerability in Rapid7 Metasploit Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. | 7.3 |
| 2017-10-06 | CVE-2017-15084 | Cross-Site Request Forgery (CSRF) vulnerability in Rapid7 Metasploit The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. | 6.5 |
| 2017-06-15 | CVE-2017-5244 | Cross-Site Request Forgery (CSRF) vulnerability in Rapid7 Metasploit Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. | 3.5 |
| 2017-03-02 | CVE-2017-5231 | Path Traversal vulnerability in Rapid7 Metasploit All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. | 7.1 |