The vulnerability of the GoLang development tool for application software “Aurora Center” relates to the execution of a loop with an unavailable exit condition, allowing attackers to cause service failures.

The vulnerability of the GoLang development tool used by Aurora Application Software involves executing a loop with an exit condition that is not met. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the cryptographic functions of the GoLang development library used by Aurora Application Software Center is related to errors in the authentication process for certificates. This error allows a perpetrator to cause service failures.

The vulnerability of the cryptographic functions of the GoLang development library used by Aurora Application Software Center is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service failures...

The vulnerability of the uglify-js library in the Aurora application software allows a hacker to execute arbitrary code by exploiting syntax errors in input data.

The vulnerability of the uglify-js library in the Avrora software application is related to syntax checking errors in input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted Java script...

The vulnerability of the GJSON library in Aurora Application Software, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the GJSON library used in Avora software applications is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending a specially crafted JSON request...

The vulnerability of the @hapi/hapi application library at Aurora Center, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the @hapi/hapi application software library in Aurora Center is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow attackers to cause service failures...

The vulnerability of the util.setPath function in the node-fetch library of the Aurora Application Center involves uncontrolled changes to prototype attributes of objects. This allows attackers to execute a “prototype pollution” attack.

The vulnerability of the util.setPath function in the node-fetch library of the Aurora Application Software is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a malicious actor to execute a “prototype pollution” attack...

The vulnerability of the deleteFunctions function in the serialize-javascript application library of Aurora Center is related to errors in code generation. This allows a perpetrator to execute arbitrary code.

The vulnerability of the deleteFunctions function in the serialize-javascript application library of Aurora Center is related to code generation control errors. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the node-fetch library in the Aurora Center’s application software, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the node-fetch library in Aurora Application Software is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to deny services through a specially crafted regular expression...

The vulnerability of the Aurora Center’s application software library lies in the uncontrolled modification of object prototypes’ attributes, allowing attackers to execute “prototype pollution” attacks.

The vulnerability of the Aurora Application Library is related to uncontrolled changes to object prototypes’ attributes. Exploiting this vulnerability allows a remote attacker to execute an “infection of the prototype” attack...

The vulnerability of the Axios application software Aurora Center, which allows a perpetrator to carry out an SSRF attack

The vulnerability of the Axios application software Autora Center relates to insufficient checking of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

The vulnerability of the `set` function in the `property-expr` library of the Afroa Application Software Center, related to uncontrolled changes to prototype attributes of objects, allows attackers to execute a “prototype pollution” attack.

The vulnerability of the Aurora Application Library is related to uncontrolled changes to object prototypes’ attributes. Exploiting this vulnerability allows a remote attacker to execute an “infection of the prototype” attack...

The vulnerability of the Aurora Application Software Debugging Library, related to uncontrolled resource consumption, allows a perpetrator to cause a service failure.

The vulnerability of the Aurora Application Programming Library’s debug library is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to deny services through a specially crafted regular expression...

The vulnerability of the Apache Thrift application programming library at Aurora Center, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Apache Thrift application programming interface at Aurora Center is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending a large number of short messages...

Aurora campaign: Attacking Azerbaijan using multiple RATs

This post was authored by Hossein Jazi As tensions between Azerbaijan and Armenia continue, we are still seeing a number of cyber attacks taking advantage of this situation. On March 5th 2021, we reported an actor that used steganography to drop a new .Net Remote Administration Trojan. Since that...

AfterLogic 多个安全漏洞（CVE-2021-26292 CVE-2021-26293 CVE-2021-26294）

CVE-2021-26292 - Public Full Path Disclosure on AfterLogic Aurora & WebMail Pro WebDAV EndPoint The severity of the issue: Medium Complexity: Easy Affected Products: AfterLogic Aurora, AfterLogic WebMail PRO Authentication: Not required Attacks: Full Path Disclosure Resources : -...

CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files such as a data/settings/settings.xml file containing admin panel credentials, as demonstrated by dav/server.php/files/personal/%2e%2e when using the...

CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files such as a data/settings/settings.xml file containing admin panel credentials, as demonstrated by dav/server.php/files/personal/%2e%2e when using the...

CVE-2021-26294

CVE-2021-26294 affects AfterLogic Aurora and WebMail Pro up to version 7.7.9. It is a directory traversal vulnerability in WebDAV endpoints (dav/server.php) that allows unauthenticated attackers to read arbitrary files (e.g., data/settings/settings.xml) by using crafted paths such as ../..//dav/s...

CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files such as a data/settings/settings.xml file containing admin panel credentials, as demonstrated by dav/server.php/files/personal/%2e%2e when using the...

Aurora 路径遍历漏洞

Afterlogic Aurora is a set of U.S. Afterlogic Inc. using PHP language written in the enterprise mail server platform. The platform includes features such as e-mail, file storage and address book management. A path traversal vulnerability exists in AfterLogic Aurora through 7.7.9 and WebMail Pro...