CVE-2024-29202

CVE-2024-29202 concerns JumpServer, an open source bastion host. Multiple connected sources confirm a Jinja2 template injection in JumpServer’s Ansible component that allows arbitrary code execution inside the Celery container. The Celery container reportedly runs with root privileges and has acc...

CVE-2024-29201

JumpServer (open source bastion host) has a vulnerability in its Ansible workflow that allows bypassing input validation to execute arbitrary code inside the Celery container, which runs with root privileges and has database access. Exploitation could lead to unauthorized data access or manipulat...

CVE-2024-29020

JumpServer (open source bastion host and O&M security audit system) contains a confidentiality flaw where an authorized attacker can obtain sensitive data from playbook files if they learn another user’s playbook_id. Affected versions are before 3.10.6. The issue is fixed in v3.10.6; remediation ...

JumpServer 安全漏洞

JumpServer is an open source bastion machine from China's Hangzhou Feizhiyun Information Technology Co. A security vulnerability exists in JumpServer versions prior to v3.10.6. The vulnerability stems from the fact that an authenticated user can upload malicious files via job IDs, compromising th...

JumpServer 安全漏洞

JumpServer is an open source bastion machine from Hangzhou Feizhiyun Information Technology Co. in China. A security vulnerability exists in JumpServer versions prior to v3.10.6, which stems from the fact that if an authorized attacker manages to learn the playbookid of another user, they can gai...

bastion-s.ru Cross Site Scripting vulnerability OBB-3884237

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-24763

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks...

Cross site scripting

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks...

PT-2024-20541 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.0 Description: The issue affects JumpServer, an open source bastion host and operation and maintenance security audit system. Attackers can exploit this to construct malicious links, leading users to click on...

CVE-2023-49961

WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure...

CVE-2023-49961

WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure...

Design/Logic Flaw

WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure...

CVE-2023-49961

WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure...

CVE-2023-49961

CVE-2023-49961 affects WALLIX Bastion (7.x–10.x) and WALLIX Access Manager (3.x–4.x) due to an Incorrect Access Control flaw that can lead to sensitive data exposure. Root cause: improper access-control checks exposing data. CVSS v3.1 base score 7.5 (HIGH). No exploitation details are provided in...

PT-2024-13843 · Wallix · Wallix Bastion +1

Name of the Vulnerable Software and Affected Versions: WALLIX Bastion versions 7.x through 10.x WALLIX Access Manager versions 3.x through 4.x Description: The issue is related to Incorrect Access Control, which can lead to sensitive data exposure. Recommendations: For WALLIX Bastion versions 7.x...

WALLIX Bastion Security Vulnerability

WALLIX Bastion is a modular solution from WALLIX France. A security vulnerability exists in WALLIX Bastion versions prior to 9.0.10, 10.0.6, and 10.4.2, which stems from incorrect access control and can be exploited by an attacker to gain unauthorized access to the...

CVE-2023-49961

WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data exposure...

JumpServer Security Vulnerability

JumpServer is an open source bastion machine from China's Hangzhou Feizhiyun Information Technology Co. A security vulnerability exists in JumpServer GPLv3 v.3.8.0, which stems from improper privilege management. An attacker can execute arbitrary code by exploiting the vulnerability...

CVE-2023-48712

Warpgate prior to version 0.9.0 contains a privilege escalation vulnerability where a non-admin user can impersonate an admin account during login when single‑factor auth is configured. An attacker who knows an admin username and tries a wrong password, then re-enters a valid non-admin username a...

Warpgate Security Breach

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux from the warp-tech project. A security vulnerability exists in Warpgate versions prior to 0.9.0. An attacker can escalate privileges by exploiting the vulnerability...