501 matches found
Neo4j 路径遍历漏洞
Neo4j is a Java-based and fully ACID-compatible graph database from Neo4j, Inc. that supports data migration, add-ons, and more. A path traversal vulnerability exists in Neo4j Graph, which stems from a directory traversal vulnerability in the Apoc plugin in Neo4j Graph databases 4.0.0 through 4.3...
CVE-2021-42767: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1...
GHSA-4MPJ-488R-VH6M Neo4j Graph Database vulnerable to Path Traversal
Impact Directory Traversal Vulnerabilities found in several functions of apoc plugins in Neo4j Graph database. The attacker can retrieve and download files from outside the configured directory on the affected server. Under some circumstances, the attacker can also create files. Patches The users...
Neo4j Graph Database vulnerable to Path Traversal
Impact Directory Traversal Vulnerabilities found in several functions of apoc plugins in Neo4j Graph database. The attacker can retrieve and download files from outside the configured directory on the affected server. Under some circumstances, the attacker can also create files. Patches The users...
PT-2022-11681 · Neo4J · Neo4J Graph Database
Name of the Vulnerable Software and Affected Versions: Neo4J Graph database versions 4.0.0 through 4.3.6 Neo4J Graph database versions prior to 3.5.17 Neo4J Graph database versions prior to 4.2.10 Neo4J Graph database versions prior to 4.3.0.4 Neo4J Graph database versions prior to 4.4.0.1...
Deserialization of Untrusted Data in Neo4j
Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...
GHSA-PC4W-8V5J-29W9 Deserialization of Untrusted Data in Neo4j
Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...
CVE-2021-34371
Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...
CVE-2021-34371
Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...
CVE-2021-34371
Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...
Remote code execution
Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...
CVE-2021-34371
Summary of the issue (CVE-2021-34371): Neo4j up to version 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, such as via setSessionVariable. This can enable remote code execution because gadget chains exist in the affected environment. In pr...
CVE-2021-34371
Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...
Neo4j 代码问题漏洞
Neo4j is a Java-based and fully ACID-compatible graphical database from Neo4j, Inc. that supports data migration, add-ons, and more. A code issue vulnerability exists in neo4j that originates from an RMI service that arbitrarily deserializes Java objects. An attacker exploiting this vulnerability...
PT-2021-20483
Name of the Vulnerable Software and Affected Versions: Neo4j versions prior to 3.4.18 Description: The issue allows for remote code execution due to the arbitrary deserialization of Java objects. This can be achieved through the setSessionVariable function, which is part of the RMI service expose...
CVE-2021-34371: Deserialization of Untrusted Data
Neo4j through 3.4.18 with the shell server enabled exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains...
Neo4j has unspecified vulnerabilities
Neo4j is a Java-based and fully ACID-compatible graph database from Neo4j, which supports data migration, add-ons, etc. A security vulnerability exists in Neo4j Graph Database versions 4.2 and 4.3, which stems from a failure to reset the security environment during certain transaction operations ...
Neo4j 3.4.18 - RMI based Remote Code Execution (RCE)
Exploit Title: Neo4j 3.4.18 - RMI based Remote Code Execution RCE Date: 7/30/21 Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: neo4j.com Software Link: https://neo4j.com/download-thanks/?edition=community&release=3.4.18&flavour=unix Version: 3.4.18 Tested on:...
Neo4j 3.4.18 - RMI based Remote Code Execution Exploit
Exploit Title: Neo4j 3.4.18 - RMI based Remote Code Execution RCE Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: neo4j.com Software Link: https://neo4j.com/download-thanks/?edition=community&release=3.4.18&flavour=unix Version: 3.4.18 Tested on: Windows, Mac In old...
Neo4j 3.4.18 Remote Code Execution
Exploit Title: Neo4j 3.4.18 - RMI based Remote Code Execution RCE Date: 7/30/21 Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: neo4j.com Software Link: https://neo4j.com/download-thanks/?edition=community&release=3.4.18&flavour=unix Version: 3.4.18 Tested on:...