227 matches found
CVE-2021-40870
CVE-2021-40870 Aviatrix 中允许已认证用户上传危险类型文件，从而执行任意代码 https://attackerkb.com/assessments/970a9fa9-223d-4d07-bafa-a338147934f3...
CVE-2021-40870
CVE-2021-40870 Carga sin restricciones de archivos con tipo peligroso en Aviatrix permite a un usuario autenticado ejecutar código arbitrario...
CVE-2021-40870
CVE-2021-40870 Exploitation 在 Aviatrix Controller 6.x（6.5-1804.1922 之前版本）中发现了一个问题。存在对危险类型文件的无限制上传，允许未经身份验证的用户通过目录遍历执行任意代码。 需要安装的模块 要运行此项目，你需要在 Python 中添加以下模块： requests urllib3 使用方法 要运行此项目，你需要执行以下操作： root@kitploit: python3 poc.py https://site.com/ URL 末尾必须包含 / 🔗 链接...
CVE-2024-50603
CVE-2024-50603：Aviatrix Controller 未授权命令注入 CVEHunter 工具，用于 CVE-2024-50603 的漏洞检测与利用，具备异步性能。 安装 root@kitploit: git clone https://github.com/th3gokul/CVE-2024-50603.git cd CVE-2024-50603 pip install -r requirements.txt python3 cvehunter.py --help@RevoltSecurities root@kitploit: python3 cvehunter.py ...
CVE-2021-40870
CVE-2021-40870 Aviatrix permite a un usuario autenticado ejecutar código arbitrario...
Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution
Aviatrix Controller 6.x before 6.5-1804.1922 contains a vulnerability that allows unrestricted upload of a file with a dangerous type, which allows an unauthenticated user to execute arbitrary code via directory traversal. id: CVE-2021-40870 info: name: Aviatrix Controller 6.x before 6.5-1804.192...
Aviatrix Controller - Remote Code Execution
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloudtype for...
CVE-2021-31776
Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconfigured to allow unprivileged users to write to directories that are supposed to be restricted to administrators...
CVE-2022-38368
An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands...
CVE-2020-7224
The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued value set; the parameters could allow unauthorized third-party libraries to load...
Aviatrix Controller Unrestricted Upload of File (CVE-2021-40870)
While the Aviatrix UI requires authentication, many API calls do not enforce a check for authentication. Some of these API calls allow an unauthenticated attacker to upload arbitrary files, including .php scripts, to the filesystem. These uploaded scripts will be processed by the web frontend,...
Aviatrix Controllers < 7.1.4191 / 7.2 < 7.2.4996 RCE
The version of Aviatrix Controller installed on the remote host is prior to 7.1.4191 for 7.1.x or prior to 7.2.4996 for 7.2.x. It is, therefore, affected by an OS command injection vulnerability caused by improper neutralization of special elements in API input. An unauthenticated attacker can se...
MAL-2025-48092 Malicious code in @aviatrixdev/flight-suit1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f67f0297879682bb09001ab95a186ca13c641603c6a4694b81972b68d8a7b55d The OpenSSF Package Analysis project identified '@aviatrixdev/flight-suit1' @ 1.1.25050 npm as malicious. It is considered malicious because: -...
EUVD-2019-7791
Malware in sbrugna...
EUVD-2019-7792
Malware in sbrugna...
EUVD-2020-19098
Malware in sbrugna...
EUVD-2020-19095
Malware in sbrugna...
EUVD-2020-20076
Malware in sbrugna...