CVE-2023-49566: Deserialization of Untrusted Data

In Apache Linkis =1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to...

CVE-2023-41916: Files or Directories Accessible to External Parties

In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which stems from a reference counting error in the fpga:manager module...

CVE-2024-27625

CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting XSS. This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field...

GHSA-PJ5J-W7MW-W797 Apache Linkis Zip Slip issue

In Apache Linkis =1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to version 1.3.2...

Apache Linkis Directory Traversal Vulnerability

Apache Linkis is a library of the U.S. Apache Apache Foundation. Helps to easily connect various backend compute/storage engines. A directory traversal vulnerability exists in Apache Linkis 1.3.1 and earlier versions, which stems from the Manager module not checking the zip path when uploading...

CVE-2023-27603

In Apache Linkis =1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to version 1.3.2...

CVE-2023-27603 Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue

In Apache Linkis =1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to version 1.3.2...

CVE-2023-27603

In Apache Linkis =1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to version 1.3.2...

Apache Linkis 路径遍历漏洞

Apache Linkis is a library of the U.S. Apache Apache Foundation. Helps to easily connect various backend compute/storage engines. A directory traversal vulnerability exists in Apache Linkis 1.3.1 and earlier versions, which stems from the Manager module not checking the zip path when uploading...

CVE-2023-27603: Improper Limitation of a Pathname to a Restricted Directory

In Apache Linkis =1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to version 1.3.2...

CVE-2018-14384

The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting XSS vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter...

CVE-2019-16967

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...

CVE-2019-16967

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...

CVE-2019-16967

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...

CVE-2019-16967

The CVE affects FreePBX Manager: versions 13.x before 13.0.2.6 and 15.x before 15.0.6 (prior to FreePBX 14.0.10.3). The vulnerability is a reflected XSS in the Manager module form (html/admin/modules/manager/views/form.php) due to an unsanitized managerdisplay value from the URL, exposed via GET ...

PT-2019-14887

Name of the Vulnerable Software and Affected Versions FreePBX versions 13.x through 13.0.2.5 FreePBX versions 15.x through 15.0.5 FreePBX version 14.0.10.2 and earlier Description An issue was discovered in the Manager module, where an unsanitized managerdisplay variable from the URL is reflected...

DEBIAN-CVE-2017-15924

In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the addserver, buildconfig, and constructcommandline functions...

CVE-2017-15235

The File Manager gollem module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename...

PT-2017-16691

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center IMC SOM version v7.3 E0501 Description A Remote Unauthenticated Disclosure of Information issue was discovered, potentially allowing unauthorized access to sensitive information. The vulnerability is related t...