Sign upLogin

rapid7/metasploit-framework

View on GitHub
Star

Showing 7,361 of 22,177 total issues

Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Netgear DGN1000B setup.cgi Remote Command Execution',
      'Description' => %q{
          Some Netgear Routers are vulnerable to authenticated OS Command injection. The
Severity: Major
Found in modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb - About 2 hrs to fix

    Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'OpenTSDB 2.4.1 unauthenticated command injection',
    Severity: Major
    Found in modules/exploits/linux/http/opentsdb_key_cmd_injection.rb - About 2 hrs to fix

      Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

        def initialize(info = {})
    super(update_info(info,
      'Name'           => 'IBM QRadar SIEM Unauthenticated Remote Code Execution',
      'Description'    => %q{
        IBM QRadar SIEM has three vulnerabilities in the Forensics web application
      Severity: Major
      Found in modules/exploits/linux/http/ibm_qradar_unauth_rce.rb - About 2 hrs to fix

        Method exploit has 56 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def exploit
    res = send_request_cgi({
            'method' => 'POST',
            'uri' => normalize_uri(datastore['TARGETURI'], "login.php"),
            'vars_post' => {
        Severity: Major
        Found in modules/exploits/linux/http/nuuo_nvrmini_auth_rce.rb - About 2 hrs to fix

          Method build_obj has 56 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def build_obj(obj_data)
    payload_data = '00000000aced00057372002f6f72672e6170616368652e636f6d6d6f6e732e636f6c6c656374696f6e732e6d61702e5265666572656e63654d61'
    payload_data << '701594ca03984908d7030000787077110000000000000001003f40000000000010737200286a6176612e7574696c2e636f6e63757272656e742'
    payload_data << 'e436f70794f6e577269746541727261795365744bbdd092901569d70200014c0002616c74002b4c6a6176612f7574696c2f636f6e6375727265'
    payload_data << '6e742f436f70794f6e577269746541727261794c6973743b7870737200296a6176612e7574696c2e636f6e63757272656e742e436f70794f6e5'
          Severity: Major
          Found in modules/exploits/linux/http/jenkins_cli_deserialization.rb - About 2 hrs to fix

            Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
            Open

              def initialize(info = {})

    super(update_info(info,
      'Name'           => 'Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow',
      'Description'    => %q{
            Severity: Major
            Found in modules/exploits/linux/http/nginx_chunked_size.rb - About 2 hrs to fix

              Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Fortinet FortiNAC keyUpload.jsp arbitrary file write',
              Severity: Major
              Found in modules/exploits/linux/http/fortinac_keyupload_file_write.rb - About 2 hrs to fix

                Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'F5 BIG-IP TMUI AJP Smuggling RCE',
                Severity: Major
                Found in modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb - About 2 hrs to fix

                  Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'DLINK DWL-2600 Authenticated Remote Command Injection',
                  Severity: Major
                  Found in modules/exploits/linux/http/dlink_dwl_2600_command_injection.rb - About 2 hrs to fix

                    Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def initialize(info = {})
    super(update_info(info,
      'Name'           => 'PostgreSQL for Linux Payload Execution',
      'Description'    => %q{
        On some default Linux installations of PostgreSQL, the
                    Severity: Major
                    Found in modules/exploits/linux/postgres/postgres_payload.rb - About 2 hrs to fix

                      Method get_crypto_keys has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def get_crypto_keys(log_folder)
    # Run commands according to the session type
    if session.type =~ /shell/

      # Enumerate and retreave files according to privilege level
                      Severity: Major
                      Found in modules/post/osx/gather/enum_osx.rb - About 2 hrs to fix

                        Method run has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                        Open

                          def run
    iprange = datastore['RHOSTS']
    print_status("Performing DNS Reverse Lookup for IP range #{iprange}")
    iplst = []
                        Severity: Major
                        Found in modules/post/multi/gather/dns_reverse_lookup.rb - About 2 hrs to fix

                          Method run has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                          Open

                            def run
    srvrcd = [
      '_gc._tcp.', '_kerberos._tcp.', '_kerberos._udp.', '_ldap._tcp.',
      '_test._tcp.', '_sips._tcp.', '_sip._udp.', '_sip._tcp.', '_aix._tcp.',
      '_aix._tcp.', '_finger._tcp.', '_ftp._tcp.', '_http._tcp.', '_nntp._tcp.',
                          Severity: Major
                          Found in modules/post/multi/gather/dns_srv_lookup.rb - About 2 hrs to fix

                            Method run has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                            Open

                              def run
    unless is_root?
      print_error('This module requires root permissions.')
      return
    end
                            Severity: Major
                            Found in modules/post/android/gather/sub_info.rb - About 2 hrs to fix

                              Method parse_cache_entry has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                              Open

                                def parse_cache_entry(cache_data)
    j = Struct.new(
      :userNameLength,
      :domainNameLength,
      :effectiveNameLength,
                              Severity: Major
                              Found in modules/post/windows/gather/cachedump.rb - About 2 hrs to fix

                                Method run has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                                Open

                                  def run
    key = 'HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\FTP Navigator_is1\\'
    val_name = 'InstallLocation'
    installdir = registry_getvaldata(key, val_name) || 'c:\\FTP Navigator\\'
                                Severity: Major
                                Found in modules/post/windows/gather/credentials/ftpnavigator.rb - About 2 hrs to fix

                                  Method initialize has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                                  Open

                                    def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Windows Manage Persistent EXE Payload Installer',
                                  Severity: Major
                                  Found in modules/post/windows/manage/persistence_exe.rb - About 2 hrs to fix

                                    Method run has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                                    Open

                                      def run
    # docker install, and default path according to https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#api-audit-log-options
    fail_with Failure::BadConfig, "#{datastore['LOGFILE']} is not readable or not found" unless readable?(datastore['LOGFILE'])

    log = read_file(datastore['LOGFILE'])
                                    Severity: Major
                                    Found in modules/post/linux/gather/rancher_audit_log_leak.rb - About 2 hrs to fix

                                      Method send has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                                      Open

                                            def send(argument,type=Net::DNS::A,cls=Net::DNS::IN)
        if @config[:nameservers].size == 0
          raise ResolverError, "No nameservers specified!"
        end
                                      Severity: Major
                                      Found in lib/net/dns/resolver.rb - About 2 hrs to fix

                                        Method gss_wrap has 56 lines of code (exceeds 25 allowed). Consider refactoring.
                                        Open

                                                  def gss_wrap(plaintext, key, sequence_number, is_initiator, opts={})
            dce_style = opts.fetch(:dce_style) { false }
            pad_style = opts.fetch(:rc4_pad_style) { :single_byte }
            # Always 32-bit sequence number
            sequence_number &= 0xFFFFFFFF
                                        Severity: Major
                                        Found in lib/rex/proto/kerberos/crypto/rc4_hmac.rb - About 2 hrs to fix
                                          Severity
                                          Category
                                          Status
                                          Source
                                          Language