CVE-2024-33443

The CVE-2024-33443 entry concerns onethink v1.1, where a crafted script to AddonsController.class.php enables remote arbitrary code execution. The issue is exposed over the network with low privileges and no user interaction. The available connected sources describe the vulnerable component as Ad...

Cross site request forgery (csrf)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

Cross site request forgery (csrf)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2017-14323

SSRF Server Side Request Forgery in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter...

CVE-2017-14323

CVE-2017-14323 describes a Server-Side Request Forgery (SSRF) in Onethink’s Ueditor component, specifically in getRemoteImage.php used by Onethink V1.0 and V1.1. An attacker can use the upfile parameter to fetch or reach internal network resources and, per sources, potentially trigger remote comm...