Posted by disclosure via Fulldisclosure on Aug 170day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software). The research is published and a proof-of-concept is available. Authenticated RCE (command injection) (CVSS 8.8, authenticated) Kerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method Server.startEncryption. The password parameter is double-quoted and concatenated...