CVE-2020-9495

CVE-2020-9495 PoC CVE-2020-9495 是 Apache Archiva 2.2.5 之前版本中的一个中等严重程度的 LDAP 注入漏洞。它允许攻击者检索 LDAP 服务器上存在的用户的任何 LDAP 属性值。 来自 Apache Archiva 官方公告： 通过向 Archiva 登录表单提供特殊值，攻击者能够从连接的 LDAP 服务器检索用户属性数据。通过使用特定字符，可以修改用于查询连接 LDAP 服务器上用户的 LDAP 过滤器。通过测量响应时间，可以从 LDAP 用户对象中检索任意属性数据。 PoC poc.py 脚本演示了未经授权的攻击者如何枚举与...

EUVD-2010-3447

Malware in sbrugna...

EUVD-2019-0462

Malware in sbrugna...

EUVD-2010-4377

Malware in sbrugna...

EUVD-2011-1043

Malware in sbrugna...

EUVD-2016-5456

Malware in sbrugna...

EUVD-2019-0474

Malware in sbrugna...

EUVD-2013-2144

Malware in sbrugna...

EUVD-2011-1092

Malware in sbrugna...

EUVD-2024-0941

Malicious code in bioql PyPI...

EUVD-2024-1006

Malicious code in bioql PyPI...

EUVD-2022-2600

Malicious code in bioql PyPI...

EUVD-2022-4130

Malicious code in bioql PyPI...

EUVD-2024-0931

Malicious code in bioql PyPI...

EUVD-2022-3193

Malicious code in bioql PyPI...

EUVD-2022-5067

Malicious code in bioql PyPI...

CVE-2022-29405

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8...

CVE-2020-9495

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users...

CVE-2019-0214

In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file...

CVE-2019-0213

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva...