307 matches found
cve-2023-42820
cve-2023-42820 JumpServer ๅฝฑๅ็ๆฌ v2.24 - v3.6.4 ้ ๆๅฑๅฎณ ๅจ็ฅ้jumpserver็ฎก็ๅฐ็็จๆท่ดฆๆทๅฏนๅบ็้ฎ็ฎฑ็ๆ ๅตไธ๏ผ้ป่ฎคไธบ admin/[email protected]๏ผ ๅฏ้่ฟๆผๆด้็ฝฎ็ฎก็ๅฐ็็ฎก็ๅ็จๆทๅฏ็ ๏ผๅนถไธ้ ๅjumpserver็ CVE-2023-42819 ๆผๆด๏ผๆ็ปๅฏไปฅgetshell show...
jumpserver
An open-source PAM platform Bastion Host !license-shieldlicense-link !docs-shielddocs-link !deepwiki-shielddeepwiki-link !discord-shielddiscord-link !docker-shielddocker-link !github-release-shieldgithub-release-link !github-stars-shieldgithub-stars-link English ยท ไธญๆ็ฎไฝ ยท ไธญๆ็น้ซ ยท ๆฅๆฌ่ช ยท Portuguรชs...
jumpserver
ไธไธชๅผๆบ็ PAM ๅนณๅฐ ๅ กๅไธปๆบ !license-shieldlicense-link !docs-shielddocs-link !deepwiki-shielddeepwiki-link !discord-shielddiscord-link !docker-shielddocker-link !github-release-shieldgithub-release-link !github-stars-shieldgithub-stars-link !gitcode-shieldgitcode-link English ยท ไธญๆ็ฎไฝ ยท ไธญๆ็น้ซ ยท ๆฅๆฌ่ช ยท Portugu...
JumpServer - Open Redirect via Referer Header
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. id:...
JumpServer > 3.6.4 - Information Disclosure
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...
JumpServer < 3.10.0 - Open Redirect
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks...
blackjump
blackjump ไธญๆ | English ๅ ่ดฃๅฃฐๆ: ๆฌๅทฅๅ ทไป ้ขๅๅๆณๆๆ็ไผไธๅฎๅ จๅปบ่ฎพ่กไธบ๏ผๅจไฝฟ็จๆฌๅทฅๅ ท่ฟ่กๆฃๆตๆถ๏ผๆจๅบ็กฎไฟ่ฏฅ่กไธบ็ฌฆๅๅฝๅฐ็ๆณๅพๆณ่ง๏ผๅนถไธๅทฒ็ปๅๅพไบ่ถณๅค็ๆๆใ่ฏทๅฟๅฏน้ๆๆ็ฎๆ ไฝฟ็จ ใ ๅฆๆจๅจไฝฟ็จๆฌๅทฅๅ ท็่ฟ็จไธญๅญๅจไปปไฝ้ๆณ่กไธบ๏ผๆจ้่ช่กๆฟๆ ็ธๅบๅๆ๏ผๆไปฌๅฐไธๆฟๆ ไปปไฝๆณๅพๅ่ฟๅธฆ่ดฃไปป ใ JumpServer ๅ กๅๆบ็ปผๅๆผๆดๅฉ็จ ๆชๆๆไปปๆ็จๆทๅฏ็ ้็ฝฎ CVE-2023-42820 ๆชๆๆไธ้ฎไธ่ฝฝๆๆๆไฝๅฝๅ CVE-2023-42442 ๆชๆๆไปปๆๅฝไปคๆง่กๆผๆด RCE 2021 ๅฎ่ฃ python3 -m pip install -r requirements.txt...
CVE-2023-42820
CVE-2023-42820 CVE-2023-42820 ๆผๆด่ฏดๆ JumpServer ๅฏ็ ้็ฝฎๆผๆด USAGE V2 Update 1. ๅ จๆฐ้ๆ 2. ๆฐๅขๆฒกๆๆฅๆถๅฐ่ดฆๆทๅ้ฎ็ฎฑ็ๆ ๅตไธ๏ผไฝฟ็จ้ป่ฎค่ดฆๆทๅ้ฎ็ฎฑ 3. ๆน่ฟๅฏน้ช่ฏ็ ็่ฏๅซๅ่ฎก็ฎ 4. ่ชๅจไฟฎๆนๅฏ็ 5. ๅฑ่ฝๅคไฝ็logs่พๅบ V1 ่ฎก็ฎ้ช่ฏ็ ้่ฆๆๅฎๅฏนๅบ้ฎ็ฎฑ็็จๆทๅ๏ผ่ฟ่กๅไผ่ชๅจๅคๆญๆฏๅฆๅญๅจๆผๆด๏ผๅนถๅฐ่ฏ่ฎก็ฎ้ช่ฏ็ python CVE-2023-42820.py -t http://IP:Port -e email -u username โโโโโโโโโโ โโโโโโโโโโโ โโโโโโโ โโโโโโโ...
CVE-2023-42442
CVE-2023-42442 CVE-2023-42442 JumpServer Session ๅฝๅไปปๆไธ่ฝฝๆผๆด ๆผๆด่ฏดๆ CVE-2023-42442ๆฏไธไธช็ปๅๆด๏ผๅ ๅซJumpserverไธญ็ไธคไธชBug 1. APIๆชๆๆ่ฎฟ้ฎๅฏผ่ดๆณ้ฒsessionไฟกๆฏ 2. ็ฎๅฝๆ้็ป่ฟๅฏผ่ดๅฝๅๆไปถ่ขซไธ่ฝฝ USAGE Python Version python CVE-2023-42442.py -h โโโโโโโโโโ โโโโโโโโโโโ โโโโโโโ โโโโโโโ โโโโโโโ โโโโโโโ โโโ โโโโโโโโโโ โโโ โโโโโโ โโโโโโโโโโ...
CVE-2023-42442
็บข้ๆป้ฒไนJumpServerๆชๆๆ่ฎฟ้ฎๆผๆดCVE-2023-42442ๅๅฉ็จ่ฟ็จๅไบซ ไฝฟ็จๆนๆณ๏ผgo run CVE-2023-42442.go --url http://192.168.123.120 ่ฏฆ่งๅพฎไฟกๅ ฌไผๅทๆ็ซ ๏ผhttps://mp.weixin.qq.com/s/NCSnTsOMxslmf5S6d9896A...
CVE-2023-42819
CVE-2023-42819 CVE-2023-42819 ๆผๆด่ฏดๆ JumpServer ไปปๆๆไปถๅๅ ฅๆผๆด CVE-2023-42819 + CVE-2023-42820 = GetShell USAGE 1. ๅฐ่ๆฌๅๆ้ๆไปถๆพๅจๅไธไธช็ฎๅฝ 2. ็กฎ่ฎคๅทฒๅฎ่ฃ Google Chrome๏ผๅนถ่ทๅ Google Chrome ็็ๆฌๅท reg query "HKEYCURRENTUSER\Software\Google\Chrome\BLBeacon" /v version 3. ๆ นๆฎ Google Chrome ๅฏนๅบ็็ๆฌๅทๅ็ณป็ปไธ่ฝฝ chromedriver ไนๅ๏ผๆพ็ฝฎๅจ...
jumpserver v5.0.0
An open-source PAM platform Bastion Host !license-shieldlicense-link !docs-shielddocs-link !deepwiki-shielddeepwiki-link !discord-shielddiscord-link !docker-shielddocker-link !github-release-shieldgithub-release-link !github-stars-shieldgithub-stars-link English ยท ไธญๆ็ฎไฝ ยท ไธญๆ็น้ซ ยท ๆฅๆฌ่ช ยท Portuguรชs...
CVE-2026-44846
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...
CVE-2026-44845
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...
CVE-2026-54336
JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...
CVE-2026-44846
JumpServer (open-source bastion host) has a privilege escalation flaw in apps/users/api/user.py: a user with users.invite_user permission can POST to /api/v1/users/users/invite/ with an existing member, triggering user.org_roles.set(org_roles) which overwrites that member's org rolesโescalating p...
EUVD-2026-60469
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...
CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...
CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...
CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...