jumpserver

An open-source PAM platform Bastion Host English · 中文简体 · 中文繁體 · 日本語 · Português Brasil · Español · Русский · 한국어 What is JumpServer? JumpServer is an open-source Privileged Access Management PAM platform that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes,...

jumpserver

Una plataforma PAM de código abierto Bastion Host ¿Qué es JumpServer? JumpServer es una plataforma de Gestión de Acceso Privilegiado PAM de código abierto que proporciona a equipos de DevOps y TI acceso seguro y bajo demanda a SSH, RDP, Kubernetes, bases de datos y puntos finales de RemoteApp a...

cve-2023-42820

cve-2023-42820 JumpServer Versiones afectadas v2.24 - v3.6.4 Peligro causado Conociendo el correo electrónico correspondiente a la cuenta de usuario de la consola de administración de Jumpserver por defecto admin/[email protected], se puede restablecer la contraseña del usuario administrador...

JumpServer - Open Redirect via Referer Header

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. id:...

JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

JumpServer < 3.10.0 - Open Redirect

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks...

blackjump

blackjump Chino | Inglés Descargo de responsabilidad: esta herramienta está destinada únicamente a actividades legítimas y autorizadas de construcción de seguridad empresarial. Al utilizar esta herramienta para realizar pruebas, debe asegurarse de que dicha actividad cumple con las leyes y...

CVE-2023-42820

CVE-2023-42820 CVE-2023-42820 Descripción de la vulnerabilidad Vulnerabilidad de restablecimiento de contraseña en JumpServer USAGE V2 Update 1. Reestructuración completa 2. Nuevo: cuando no se reciben la cuenta y el correo electrónico, se utilizan la cuenta y el correo electrónico predeterminado...

CVE-2023-42442

CVE-2023-42442 CVE-2023-42442 Vulnerabilidad de descarga arbitraria de grabaciones de sesión de JumpServer Descripción de la vulnerabilidad CVE-2023-42442 es una vulnerabilidad combinada que incluye dos errores en Jumpserver 1. Acceso no autorizado a la API que filtra información de sesión 2...

CVE-2023-42442

Red Team Offense and Defense: Post-Exploitation Process Sharing for JumpServer Unauthorized Access Vulnerability CVE-2023-42442 Usage: go run CVE-2023-42442.go --url http://192.168.123.120 For details, see the WeChat public account article: https://mp.weixin.qq.com/s/NCSnTsOMxslmf5S6d9896A...

CVE-2023-42819

CVE-2023-42819 CVE-2023-42819 Descripción de la vulnerabilidad Vulnerabilidad de escritura arbitraria de archivos en JumpServer CVE-2023-42819 + CVE-2023-42820 = GetShell USO 1. Coloque el script y los archivos necesarios en el mismo directorio 2. Asegúrese de que Google Chrome esté instalado y...

CVE-2026-44846

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-44845

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

CVE-2026-54336

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...

CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-44846

JumpServer (open-source bastion host) has a privilege escalation flaw in apps/users/api/user.py: a user with users.invite_user permission can POST to /api/v1/users/users/invite/ with an existing member, triggering user.org_roles.set(org_roles) which overwrites that member's org roles—escalating p...

CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-44845

JumpServer versions prior to 4.10.17 allow an authenticated administrator with Applet Host permissions to inject Jinja2 expressions into the IP/Host or Core Service Address fields, causing Ansible to evaluate them during deployment and execute arbitrary commands on the control node. The fix is in...

CVE-2026-44845 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

CVE-2026-44845 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...