com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=1.0.0, <=1.1.0), com.yoozoo.protoconf:protoconf-java (>=0.2.2, <=0.2.3) +9 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=2.0.0.release, <=2.0.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.0.0.release, =1.0.0, =0.2.2, =1.0.2, =0.0.2, =darwin.release, =0.2.1.release, =2.0.0.release, =2.0.3.release - xyz.weechang:moreco-cloud-config 0.0.1 Source cves: CVE-2019-3799 Source advisory: OSV:GHSA-4X49-W62V-76Q7...

ai.hyacinth.framework:core-service-config-server (0.5.0), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=6.0.1, <=6.1.0-rc2) +12 more potentially affected by CVE-2019-3799 via org.springframework.cloud:spring-cloud-config-server (>=2.1.0.release, <=2.1.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.1.0.release, =6.0.1, =6.0.1, =6.0.1, =einstein.release, =2.1.0.release, =2.1...

CVE-2019-3799 Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a...

CVE-2019-3799

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a...

CVE-2019-3799: Improper Limitation of a Pathname to a Restricted Directory

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a...

Exploit for Path Traversal in Vmware Spring_Cloud_Config

CVE-2019-3799 - Spring-Cloud-Config-Server Directory Traversal...

Directory Traversal

spring-cloud-config-server is vulnerable to directory traversal. It is possible because an attacker can serve arbitrary configuration files to the sever through a malicious URL feed into spring-cloud-config-server module...

Directory Traversal with spring-cloud-config-server

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a...

Citrix NetScaler SOAP Handler Remote Code Execution Exploit

This Metasploit module exploits a memory corruption vulnerability on the Citrix NetScaler Appliance. The vulnerability exists in the SOAP handler, accessible through the web interface. A malicious SOAP requests can force the handler to connect to a malicious NetScaler config server. This maliciou...

Citrix NetScaler SOAP Handler Remote Code Execution

This module exploits a memory corruption vulnerability on the Citrix NetScaler Appliance. The vulnerability exists in the SOAP handler, accessible through the web interface. A malicious SOAP requests can force the handler to connect to a malicious NetScaler config server. This malicious config...

aeolus-configserver: aeolus-configserver-setup /tmp file conductor credentials leak

aeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for a temporary file in /tmp, which allows local users to read credentials by reading this file...

PT-2004-1439 · Allmyvisitors +3 · Allmyvisitors +3

Name of the Vulnerable Software and Affected Versions: AllMyVisitors affected versions not specified AllMyLinks affected versions not specified AllMyGuests affected versions not specified Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the AMVconfigcfg...