The vulnerability of the set function in the object-path library of the Aurora Application Software Center, related to uncontrolled changes to prototype attributes of objects, allows attackers to execute a “prototype pollution” attack.

The vulnerability of the set function in the object-path library of the Aurora application software is related to uncontrolled changes in object prototypes’ attributes. Exploiting this vulnerability could allow a malicious actor to execute an “infection of the prototype” attack...

The vulnerability of the Aurora Center’s application software library involves uncontrolled changes to object prototypes’ attributes, allowing attackers to execute “prototype pollution” attacks.

The vulnerability of the Aurora Application Programming Library involves uncontrolled changes to object prototypes’ attributes. Exploiting this vulnerability allows a remote attacker to execute an “infection of the prototype” attack...

The vulnerability of the Lodash application library of Aurora Center lies in the failure to take measures to neutralize special elements used in the operating system’s command set, allowing attackers to execute arbitrary commands.

The vulnerability of the Lodash application library in Aurora Software Solutions relates to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the yargs-parser library in application software of Aurora Center involves uncontrolled changes to object prototypes’ attributes, allowing attackers to execute “prototype pollution” attacks.

The vulnerability of the yargs-parser library in application software developed by Avora Center relates to uncontrolled changes to object prototypes’ attributes. Exploiting this vulnerability could allow a malicious actor to execute a “prototype compromise” attack...

The vulnerability of the Aurora Application Software Debugging Library, related to uncontrolled resource consumption, allows a perpetrator to cause a service failure.

The vulnerability of the Aurora Application Programming Library’s debug library is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to deny services through a specially crafted regular expression...

The vulnerability of the cryptographic functions of the GoLang development library used by Aurora Application Software Center is related to errors in the authentication process for certificates. This error allows a perpetrator to cause service failures.

The vulnerability of the cryptographic functions of the GoLang development library used by Aurora Application Software Center is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service failures...

The vulnerability of the GoLang development tool for application software “Aurora Center” relates to the execution of a loop with an unavailable exit condition, allowing attackers to cause service failures.

The vulnerability of the GoLang development tool used by Aurora Application Software involves executing a loop with an exit condition that is not met. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the y18n application library at Avora Center lies in the uncontrolled modification of object prototypes’ attributes, allowing attackers to execute “prototype pollution” attacks.

The vulnerability of the y18n application library in Aurora Software Center is related to uncontrolled changes to object prototypes’ attributes. Exploiting this vulnerability could allow a malicious actor to execute a “prototype contamination” attack remotely...

The vulnerability of the Axios application software Aurora Center, which allows a perpetrator to carry out an SSRF attack

The vulnerability of the Axios application software Autora Center relates to insufficient checking of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

The vulnerability of the Apache Thrift application programming library at Aurora Center, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Apache Thrift application programming interface at Aurora Center is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending a large number of short messages...

Aurora campaign: Attacking Azerbaijan using multiple RATs

This post was authored by Hossein Jazi As tensions between Azerbaijan and Armenia continue, we are still seeing a number of cyber attacks taking advantage of this situation. On March 5th 2021, we reported an actor that used steganography to drop a new .Net Remote Administration Trojan. Since that...

AfterLogic 多个安全漏洞（CVE-2021-26292 CVE-2021-26293 CVE-2021-26294）

CVE-2021-26292 - Public Full Path Disclosure on AfterLogic Aurora & WebMail Pro WebDAV EndPoint The severity of the issue: Medium Complexity: Easy Affected Products: AfterLogic Aurora, AfterLogic WebMail PRO Authentication: Not required Attacks: Full Path Disclosure Resources : -...

CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files such as a data/settings/settings.xml file containing admin panel credentials, as demonstrated by dav/server.php/files/personal/%2e%2e when using the...

CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files such as a data/settings/settings.xml file containing admin panel credentials, as demonstrated by dav/server.php/files/personal/%2e%2e when using the...

CVE-2021-26294

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files such as a data/settings/settings.xml file containing admin panel credentials, as demonstrated by dav/server.php/files/personal/%2e%2e when using the...

CVE-2021-26294

CVE-2021-26294 affects AfterLogic Aurora and WebMail Pro up to version 7.7.9. It is a directory traversal vulnerability in WebDAV endpoints (dav/server.php) that allows unauthenticated attackers to read arbitrary files (e.g., data/settings/settings.xml) by using crafted paths such as ../..//dav/s...

Aurora 路径遍历漏洞

Afterlogic Aurora is a set of U.S. Afterlogic Inc. using PHP language written in the enterprise mail server platform. The platform includes features such as e-mail, file storage and address book management. A path traversal vulnerability exists in AfterLogic Aurora through 7.7.9 and WebMail Pro...

CVE-2021-26293

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files such as an executable file under the web root. This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x...

CVE-2021-26293

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files such as an executable file under the web root. This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x...

Directory traversal

An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files such as an executable file under the web root. This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x...