288 matches found
CVE-2022-35246
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access...
CVE-2022-35246
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access...
CVE-2022-35246
Rocket.Chat’s CVE-2022-35246 is a NoSQL-Injection information disclosure in the getS3FileUrl Meteor server method. The vulnerability allows an authenticated user to disclose the redirect URL of arbitrary file uploads, due to insufficient access checks when retrieving the file URL. Affected versio...
CVE-2022-35246
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access...
PT-2022-22653 · Unknown · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Rocket.Chat versions prior to 4.8.2 Rocket.Chat versions prior to 4.7.5 Description: A NoSQL-Injection information disclosure issue exists in the getS3FileUrl Meteor server method, which can disclose arbitrary...
Agentejo Cockpit NoSQL Injection (CVE-2020-35846)
A NoSQL Injection vulnerability exists in Agentejo Cockpit. Successful exploitation of this vulnerability could allow attackers to inject commands and execute arbitrary code on the affected system...
NoSQL Injection Authentication Bypass
A NoSQL injection occurs when a value originating from the client's request is used within a NoSQL call without prior sanitisation. This can allow cyber-criminals to execute arbitrary NoSQL code and thus steal data, or use the additional functionality of the database server to take control of...
Rocket.Chat: NoSQL-Injection discloses S3 File Upload URLs
Summary A NoSQL-Injection vulnerability in the getS3FileUrl Meteor server method can disclose arbitrary file upload URLs to users that should not be able to access. Description The fileId argument of the getS3FileUrl Meteor server method is not validated and can contain a regular expression. The...
GitHub Security Lab: [Python] CWE-943: Add NoSQL Injection Query
This bug was reported directly to GitHub Security Lab...
Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection
Exploit Title: Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection Date: 06-08-2021 Exploit Author: Brian Ombongi Vendor Homepage: https://getcockpit.com/ Version: Cockpit 0.11.1 Tested on: Ubuntu 16.04.7 CVE : CVE-2020-35847 & CVE-2020-35848 !/usr/bin/python3 import json...
Cockpit CMS 0.11.1 - (Username Enumeration & Password Reset) NoSQL Injection Exploit
Exploit Title: Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection Exploit Author: Brian Ombongi Vendor Homepage: https://getcockpit.com/ Version: Cockpit 0.11.1 Tested on: Ubuntu 16.04.7 CVE : CVE-2020-35847 & CVE-2020-35848 !/usr/bin/python3 import json import re import...
Cockpit CMS 0.11.1 NoSQL Injection
Exploit Title: Cockpit CMS 0.11.1 - 'Username Enumeration & Password Reset' NoSQL Injection Date: 06-08-2021 Exploit Author: Brian Ombongi Vendor Homepage: https://getcockpit.com/ Version: Cockpit 0.11.1 Tested on: Ubuntu 16.04.7 CVE : CVE-2020-35847 & CVE-2020-35848 !/usr/bin/python3 import json...
CVE-2021-22910
A sanitization vulnerability exists in Rocket.Chat server versions 3.13.2, 3.12.4, 3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE...
CVE-2021-22910
A sanitization vulnerability exists in Rocket.Chat server versions 3.13.2, 3.12.4, 3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE...
Sql injection
A sanitization vulnerability exists in Rocket.Chat server versions 3.13.2, 3.12.4, 3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE...
CVE-2021-22910
A sanitization vulnerability exists in Rocket.Chat server versions 3.13.2, 3.12.4, 3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE...
CVE-2021-22910
CVE-2021-22910 affects Rocket.Chat server versions prior to 3.13.2, 3.12.4, and 3.11.4. The vulnerability is a sanitization issue in certain endpoints that allows crafted queries to trigger a NoSQL injection, potentially leading to remote code execution. Red Hat and OSV entries corroborate the sa...
PT-2021-15267 · Unknown · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat server versions prior to 3.13.2 Rocket.Chat server versions prior to 3.12.4 Rocket.Chat server versions prior to 3.11.4 Description: A sanitization issue exists in the Rocket.Chat server that allows queries to an endpoint,...
Rocket.Chat 安全漏洞
Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat server versions 3.13.2, 3.12.4, 3.11.4 that allows queries to endpoints, which can lead to NoSQL injection, which may result in an RCE...
