152 matches found
PocList
此项目暂时停止更新。在我更新到后期意识到两个问题，第一：似乎我在仓库中对安全法的声明不到位，造成了一些我不愿意看到的结果。第二：在此项目设计之初我没有考虑到一些底层架构上的东西。比如接口的通用性，比如图形化和单种框架的全版本检测才是大众更为需要的。 编写的POC Alibaba-Nacos-Unauthorized ApacheDruid-RCECVE-2021-25646 MS-Exchange-SSRF-CVE-2021-26885 Oracle-WebLogic-CVE-2021-2109RCE RG-CNVD-2021-14536 RJ-SSL-VPN-UltraVires...
CVE-2021-29441
CVE-2021-29441 运行: CVE-2021-29441.exe ip 阿里nacos 越权添加账户...
alibaba__nacos_CVE-2021-44667_2-0-3
Nacos: Dynamic Na ming and Co nfiguration S ervice...
cve-2021-29442-Nacos-Derby-rce-exp
简介 Nacos Derby命令执行漏洞利用脚本，默认使用User-Agent绕过漏洞进行利用 Nacos 是一款用于服务注册、发现和配置管理的开源平台。在其早期版本（≤2.4.0-BETA）中，Nacos 默认集成了 Apache Derby 作为嵌入式数据库。由于 Derby 数据库默认未设置访问控制，攻击者可以未经授权地访问特定接口，执行任意 SQL 语句，最终导致远程命令执行漏洞。 漏洞原理： 1. 未授权访问： 在默认配置下，Nacos 的 Derby 数据库接口未设置访问控制，允许任何人访问。 2. SQL 注入： 攻击者通过特定的 HTTP 请求，向 Nacos 的 Der...
QVD-2024-26473
QVD-2024-26473 QVD-2024-26473 && CVE-2021-29442 Búsqueda FOFA: https://fofa.info/result?qbase64=YXBwPSJOYWNvcyI%3D Búsqueda ZoomEye: https://www.zoomeye.org/searchResult?q=app%3A%22Alibaba%20Nacos%22...
Nacos <1.4.1 - Authentication Bypass
Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...
Nacos <1.4.1 - Authentication Bypass
This template only works on Nuclei engine prior to version 2.3.3 and version = 2.3.5. In Nacos before version 1.4.1, when configured to use authentication -Dnacos.core.auth.enabled=true Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nac...
Alibab-Nacos-Unauthorized-Reset-PWD
Impacto de la vulnerabilidad Se ha descubierto un problema en Nacos que afecta a Nacos = 2.2.0. Cuando un usuario utiliza la clave JWT predeterminada, un atacante puede restablecer la contraseña de cualquier usuario y tomar el control de la cuenta. Producto afectado Versión Nacos = 2.2.0...
Alibab-Nacos-Unauthorized-Login
Vuln Impact An issue has been discovered in Nacos affecting Nacos = 2.1.0.Nacos users use the default JWT key to cause an unauthorized access vulnerability. Through this vulnerability, attackers can bypass user name and password authentication and directly log in to the Nacos user Vuln Product...
nacos-cve-2021-29441
Este repositorio no tiene un README...
CVE-2021-29441
CVE-2021-29441 Ejecutar: CVE-2021-29441.exe ip Alibaba Nacos: adición de cuenta sin autorización...
CVE-2021-29441
CVE-2021-29441 - Bypass de Autenticación en Nacos CVE-2021-29441 es una vulnerabilidad crítica de bypass de autenticación que afecta a Nacos versiones anteriores a la 1.4.1. Nacos es una plataforma popular para el descubrimiento dinámico de servicios, gestión de configuración y administración de...
Spring-Cloud-Gateway-Nacos
此存储库没有 README。...
CVE-2022-40087
creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/71968 2026-09-01 20:01:20+00:00| seen| https://t.me/hackingAttack/71970 2026-09-02 01:01:35+00:00| seen| https://t.me/hackingAttack/71970 2026-09-02 01:01:36+00:00| seen|...
CVE-2026-40984 vulnerabilities
Vulnerabilities for packages: dependency-track, nacos, hono, dependency-track-apiserver, apicurio-registry-fips, keycloak-fips, keycloak, ontop, knative-kafka-broker-fips, apache-nifi, airbyte-server-fips, knative-kafka-broker, camunda-zeebe, kafka-bridge-fips, kafka-bridge, ontop-fips,...
CVE-2026-40983 vulnerabilities
Vulnerabilities for packages: keycloak-fips, dependency-track, keycloak, nacos-docker, nacos, zipkin, apache-nifi, dependency-track-apiserver, apicurio-registry-fips, airbyte-server-fips, infinispan, apicurio-registry, camunda-zeebe, request-9047-keycloak-fips, airbyte-server...
GHSA-G3PR-3P32-FP23 vulnerabilities
Vulnerabilities for packages: dependency-track, nacos, hono, dependency-track-apiserver, apicurio-registry-fips, keycloak-fips, keycloak, ontop, knative-kafka-broker-fips, apache-nifi, airbyte-server-fips, knative-kafka-broker, camunda-zeebe, kafka-bridge-fips, kafka-bridge, ontop-fips,...
GHSA-W737-WX49-QJ23 vulnerabilities
Vulnerabilities for packages: keycloak-fips, dependency-track, keycloak, nacos-docker, nacos, zipkin, apache-nifi, dependency-track-apiserver, apicurio-registry-fips, airbyte-server-fips, infinispan, apicurio-registry, camunda-zeebe, request-9047-keycloak-fips, airbyte-server...
Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation
A new Sysdig report traces how an LLM agent abused a Langflow flaw, stole credentials, reached production MySQL, and destroyed Nacos config data in minutes flat...
