CVE-2018-19859

CVE-2018-19859 - RCE 概念実証 このリポジトリには、OpenRefine 3.1-beta に対するリモートコード実行 RCE の概念実証が含まれています。Create Project 機能内部のディレクトリトラバーサル脆弱性 CVE-2018-19859 を悪用することで、悪意のあるユーザーはカスタム Java 拡張機能をアップロードしてコード実行を達成できます。 この概念実証には、ユーザーが webroot/extension/whiteoak/ にアクセスすると起動するシンプルな Java リバースシェルが含まれています。 インストール 1. バージョン 2.8...

CVE-2022-41401

OpenRefine = v3.5.2 SSRF OpenRefine v=3.5.2 包含一个服务器端请求伪造（SSRF）漏洞，该漏洞允许未经授权的用户利用系统，可能导致未经授权访问内部资源和敏感文件泄露。 此漏洞的根本原因在于 OpenRefine 对提供的 URL 缺乏充分的服务器端验证。虽然存在客户端验证，但服务器端未能执行相同级别的审查。因此，如果用户最初提供一个有效的 URI，随后将其替换为恶意 URI，服务器端系统将无法检测到这一更改。 PoC 该漏洞可在 OpenRefine...

EUVD-2018-12726

Malware in sbrugna...

EUVD-2019-13215

Malware in sbrugna...

EUVD-2023-2096

Malicious code in bioql PyPI...

EUVD-2024-2990

Malicious code in bioql PyPI...

EUVD-2024-3067

Malicious code in bioql PyPI...

EUVD-2024-3105

Malicious code in bioql PyPI...

EUVD-2024-2917

Malicious code in bioql PyPI...

EUVD-2024-0538

Malicious code in bioql PyPI...

EUVD-2023-2337

Malicious code in bioql PyPI...

EUVD-2024-3113

Malicious code in bioql PyPI...

EUVD-2024-2977

Malicious code in bioql PyPI...

EUVD-2024-2918

Malicious code in bioql PyPI...

EUVD-2023-2577

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-41401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine = v3.5.2 contains a Server-Side Request Forgery SSRF vulnerability, which permits unauthorized users to exploit the system, potentially leading to...

Linux Distros Unpatched Vulnerability : CVE-2023-41886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any...

Linux Distros Unpatched Vulnerability : CVE-2023-37476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2023-41887

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any...

CVE-2023-37476

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...