CVE-2024-55653 pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)

PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a UnhandledPromiseRejection on audits which exits the backend. The user doesn't need to know the audit id, since a bad audit id will also raise the...

CVE-2024-55602

PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal ../ sequences into the file extension property to read arbitrary files on the system. Commit...

CVE-2024-55602

PwnDoc vulnerability CVE-2024-55602 allows an authenticated user who can update and download templates to perform path traversal ("../") in the file extension field, enabling arbitrary file reads on the host. The issue is triggered prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, which i...

CVE-2024-55602 PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal

PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal ../ sequences into the file extension property to read arbitrary files on the system. Commit...

PwnDoc 输入验证错误漏洞

PwnDoc is a penetration test report generator from the PwnDoc open source. An input validation error vulnerability exists in PwnDoc 0.5.3 and earlier versions, which stems from the fact that an authenticated user can crash the backend by raising an UnhandledPromiseRejection on an audit on the exi...

PwnDoc 安全漏洞

PwnDoc is a penetration test report generator from PwnDoc open source. A security vulnerability exists in PwnDoc. An attacker exploiting the vulnerability could read arbitrary files on the system...

Exploit for Unrestricted Upload of File with Dangerous Type in Pwndoc_Project Pwndoc

Pwndoc local file inclusi...

CVE-2022-45771

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file...

Design/Logic Flaw

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file...

CVE-2022-45771

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file...

CVE-2022-45771

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file...

PT-2022-27641 · Pwndoc · Pwndoc

Name of the Vulnerable Software and Affected Versions: Pwndoc version 0.5.3 Description: An issue in the "/api/audits" component allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file. Recommendations: For Pwndoc version 0.5.3, consider disabling the...

CVE-2022-45771

CVE-2022-45771 affects Pwndoc v0.5.3, where the /api/audits component allows privilege escalation and arbitrary code execution through uploading a crafted audit file. Multiple connected documents describe two related attack chains: (1) loading user-supplied AuditSchema.language via require during...

CVE-2022-45771

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file...

Pwndoc 安全漏洞

PwnDoc is a software application. Penetration test report generator. A security vulnerability exists in Pwndoc version v0.5.3, which stems from an issue in components/api/audits and allows an attacker to elevate privileges and execute arbitrary code by uploading a crafted audit file...

CVE-2022-44023

PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...

CVE-2022-44022

PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings for authentication attempts...

Authentication flaw

PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...

CVE-2022-44023

PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response messages for authentication attempts...

PwnDoc 安全漏洞

PwnDoc is a software application. Penetration test report generator. A security vulnerability exists in PwnDoc version 0.5.3, which stems from a vulnerability that could allow a remote attacker to identify disabled user account names by exploiting the response time of authentication attempts...