61 matches found
CVE-2022-24112_POC
POC 収集したPOC CVE-2022-24112 春秋云境:CVE-2022-24112のターゲット環境を実現するために、2つのPOCを修正しました。M4xSecとtwseptianの両氏のPOCを少し変更し、春秋云境のターゲットに適応させました： 春秋云境:CVE-2022-24112： Apache APISIXは、Apache Software...
Apache-APISIX-CVE-2022-24112
Apache APISIX 远程代码执行 CVE-2022-24112 漏洞利用 摘要 攻击者可以利用 batch-requests 插件发送请求以 绕过 Admin API 的 IP 限制。 Apache APISIX 的默认配置（使用默认 API 密钥） 容易受到远程代码执行攻击。 当管理员密钥被更改或 Admin API 的端口被更改 为与数据面板不同的端口时，影响会更低。但仍 然存在绕过 Apache APISIX 数据 面板 IP 限制的风险。 batch-requests 插件中有一个检查，它会覆盖 客户端 IP 为其真实的远程 IP。但由于代码中的一个 bug，此...
Apache APISIX - Remote Code Execution
A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...
EUVD-2022-3501
Malicious code in bioql PyPI...
EUVD-2022-6269
Malicious code in bioql PyPI...
CVE-2022-24112
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...
CVE-2021-21674
A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the list of pending requests...
CVE-2021-21675
A cross-site request forgery CSRF vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests and/or have administrators apply pending requests...
WordPress plugin WooCommerce Warranty Requests Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2023-33317
Unauth. Reflected Cross-Site Scripting XSS vulnerability in WooCommerce Returns and Warranty Requests plugin = 2.1.6 versions...
CVE-2023-33317 WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in WooCommerce Returns and Warranty Requests plugin = 2.1.6 versions...
Jenkins plugins Multiple Vulnerabilities (2022-06-30)
According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulti...
Jenkins Plugin requests-plugin授权问题漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Plugin requests-plugin version...
Incorrect Authorization in Jenkins requests-plugin
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests. This is basically the...
GHSA-6XHF-XX3J-75F5 Incorrect Authorization in Jenkins requests-plugin
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests. This is basically the...
CVE-2022-34782
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests...
CVE-2022-34782
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests...
CVE-2022-34782
An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests...
