RCE & Full Read SSRF & Arbitrary File Read in /web_crawl endpoint

Description The webcrawl function in documentapp.py contains a RCE vulnerability. This function receives the URL parameter, accesses and obtains the HTML content of the URL through Chromium headless, and converts the HTML content into a PDF file. Users can obtain the converted PDF file through th...

Malicious code in design-system-intranet-header-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92014e7f1376852bd6f176fc1cefd54ea673d7e95e89db2ec6b1a960e2fb9021 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in design-system-intranet-header-workspace

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-8970 Malicious code in design-system-intranet-header-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92014e7f1376852bd6f176fc1cefd54ea673d7e95e89db2ec6b1a960e2fb9021 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-4M9P-7XG6-F4MM DataEase has an XML External Entity Reference vulnerability

Impact There is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. 1. send request: POST /de2api/staticResource/upload/1 HTTP/1.1 Host: dataease.ubuntu20.vm...

CVE-2024-46985 DataEase has an XXE vulnerability

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985 DataEase has an XXE vulnerability

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985 DataEase has an XXE vulnerability

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

CVE-2024-46985: Improper Restriction of XML External Entity Reference

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerabilit...

Hewlett Packard Enterprise Aruba Networking Virtual Intranet Access 安全漏洞

Hewlett Packard Enterprise Aruba Networking Virtual Intranet Access is part of a remote networking solution for remote workers and mobile users from Hewlett Packard Enterprise. A security vulnerability exists in Hewlett Packard Enterprise Aruba Networking Virtual Intranet Access. An attacker coul...

NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities: - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow...

CVE-2024-45058

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator or...

CVE-2024-45057

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting XSS vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at...

CVE-2024-45057: Improper Neutralization of Input During Web Page Generation

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting XSS vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at...

CVE-2024-45058: Improper Input Validation

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator or...

PT-2024-31408

Name of the Vulnerable Software and Affected Versions i-Educar versions prior to 2.9 Description A Reflected Cross-Site Scripting XSS issue was identified in the dynamic generation of HTML fields. The file ieducar/intranet/include/clsCampos.inc.php does not properly validate or sanitize...

Apache IoTDB 代码问题漏洞

Apache IoTDB is an integrated data management engine designed for time-series data from the Apache USA Foundation, which provides data collection, storage, and analysis services, among other things. Apache IoTDB suffers from a server-side request forgery vulnerability that stems from the product'...

Secure Web Error: “net::ERR_NAME_NOT_RESOLVED” while accessing Website

Android users with v5.0 and later are getting the following error while accessing intranet sites: ERRNAMENOTRESOLVED Note : The application works on Android version 5.0 and later...

CVE-2024-39347

Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager SRM before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to access highly sensitive intranet resources via unspecified vectors...