CVE-2019-17625

CVE-2019-17625 rambox 0.6.9에는 사용자가 서비스를 추가할 때 name 필드의 매개변수가 제대로 샌티타이즈되지 않아 발생하는 저장형 XSS 취약점이 있습니다. rambox는 NodeJS에서 실행되므로 OS 명령을 또는 태그에 주입할 수 있습니다. 참고: 이 코드는 MacOS에서만 테스트되었으며 다른 운영 체제에서는 재구성이 필요할 수 있습니다. 익스플로잇 코드 익스플로잇 코드는 discord를 기본으로 사용하여 서비스를 생성합니다. 셸을 실행하려면 시스템에 mkfifo가 있어야 합니다. 물론 페이로드는 원하...

EUVD-2022-1982

Malicious code in bioql PyPI...

CVE-2019-17625

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

Malicious code in rambox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63e80eb984d70eca3cfadd2c9872df353dba45f0c14111f84c9c0ab34f8b8930 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8161 Malicious code in rambox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63e80eb984d70eca3cfadd2c9872df353dba45f0c14111f84c9c0ab34f8b8930 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Rambox RCE Vulnerability

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

GHSA-2GC6-2H2G-PH48 Rambox RCE Vulnerability

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

Exploit for OS Command Injection in Rambox

CVE-2019-17625 There is a stored XSS vulnerability in rambox...

CVE-2019-17625

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

Cross site scripting

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

CVE-2019-17625

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

CVE-2019-17625

CVE-2019-17625 affects Rambox 0.6.9 with a stored XSS in the name field when adding/editing a service. The root cause is incorrect sanitization of the name field, enabling a payload that can trigger code execution in Node.js/Electron, e.g., via an onerror attribute in an IMG element. Connected so...

CVE-2019-17625: Improper Neutralization of Special Elements used in an OS Command

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...