CVE-2018-19859

CVE-2018-19859 - RCE 개념 증명 이 저장소는 OpenRefine 3.1-beta에 대한 원격 코드 실행RCE 개념 증명을 포함합니다. Create Project 기능 내의 디렉터리 트래버설 취약점 CVE-2018-19859를 악용하여 악의적인 사용자가 사용자 정의 Java 확장을 업로드하여 코드 실행을 얻을 수 있습니다. 이 개념 증명은 사용자가 webroot/extension/whiteoak/로 이동할 때 활성화되는 간단한 Java 리버스 셸을 포함합니다. 설치 1. 로컬 취약 버전의 OpenRefine예: ...

CVE-2022-41401

OpenRefine = v3.5.2 SSRF OpenRefine v=3.5.2에는 SSRFServer-Side Request Forgery 취약점이 존재합니다. 이 취약점을 통해 인증되지 않은 사용자가 시스템을 악용하여 내부 리소스에 무단 접근하거나 민감한 파일을 유출할 가능성이 있습니다. 이 취약점의 근본 원인은 OpenRefine이 제공된 URL에 대한 서버 측 검증을 적절히 수행하지 못하기 때문입니다. 클라이언트 측 검증은 존재하지만, 서버 측에서는 동일한 수준의 검증이 이루어지지 않습니다. 결과적으로 사용자가 처음에 유...

EUVD-2018-12726

Malware in sbrugna...

EUVD-2019-13215

Malware in sbrugna...

EUVD-2023-2096

Malicious code in bioql PyPI...

EUVD-2024-0538

Malicious code in bioql PyPI...

EUVD-2024-2917

Malicious code in bioql PyPI...

EUVD-2024-2990

Malicious code in bioql PyPI...

EUVD-2024-3105

Malicious code in bioql PyPI...

EUVD-2024-3067

Malicious code in bioql PyPI...

EUVD-2024-3113

Malicious code in bioql PyPI...

EUVD-2024-2977

Malicious code in bioql PyPI...

EUVD-2023-2337

Malicious code in bioql PyPI...

EUVD-2023-2577

Malicious code in bioql PyPI...

EUVD-2024-2918

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-41401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine = v3.5.2 contains a Server-Side Request Forgery SSRF vulnerability, which permits unauthorized users to exploit the system, potentially leading to...

Linux Distros Unpatched Vulnerability : CVE-2023-41886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any...

Linux Distros Unpatched Vulnerability : CVE-2023-37476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2023-41887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any...

CVE-2023-37476

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...