CVE-2021-31761

CVE-2021-31761 설명 : Webmin의 실행 중인 프로세스 기능을 통해 반사형 크로스 사이트 스크립팅XSS 공격을 악용하여 원격 명령 실행RCE을 얻는 방법 테스트 버전 : Webmin 1.973 GitHub의 최신 버전 07/03/2021 공격 유형 : 원격 영향 : 원격 명령 실행 익스플로잇 코드 PoC : YouTube PoC : https://youtu.be/23VvUMu-28c 제품 공급업체 :...

CVE-2021-31760

..| CVE-2021-31760 |.. 설명 : Webmin의 실행 중인 프로세스 기능을 통해 사이트 간 요청 위조CSRF 공격을 악용하여 원격 명령 실행RCE을 달성합니다. 테스트된 버전 : Webmin 1.973 GitHub의 최신 버전 07/03/2021 공격 유형: 원격 영향 : 원격 명령 실행 익스플로잇 코드 POC : YouTube POC : https://youtu.be/D45FN8QrzDo 제품 공급업체 :...

CVE-2021-31762

..| CVE-2021-31762 |.. 설명 : Webmin의 사용자 추가 기능을 통해 교차 사이트 요청 위조CSRF 공격을 악용하여 권한 있는 사용자를 만든 다음, Webmin의 실행 중인 프로세스 기능을 통해 리버스 셸을 획득 테스트 버전 : Webmin 1.973 GitHub의 최신 버전 07/03/2021 공격 유형: 원격 영향 : 원격 명령 실행 익스플로잇 POC 코드 : YouTube POC : https://youtu.be/qCvEXwyaF5U 제품 공급업체 : https://www.webmin.com 추가 정보...

CVE-2021-31761

..| CVE-2021-31761 |.. 설명 : Webmin의 실행 중인 프로세스 기능을 통한 반사형 XSSReflected Cross-Site Scripting 공격을 악용하여 원격 명령 실행RCE을 획득합니다 테스트 버전 : Webmin 1.973 GitHub의 최신 버전 07/03/2021 공격 유형: 원격 영향 : 원격 명령 실행 익스플로잇 코드 POC : YouTube POC : https://youtu.be/23VvUMu-28c 제품 공급업체 :...

CVE-2021-31760

..| CVE-2021-31760 |.. 描述： 通过 Webmin 的进程运行功能，利用跨站请求伪造（CSRF）攻击获取远程命令执行（RCE） 测试版本： Webmin 1.973（GitHub 上 2021 年 3 月 7 日的最新版本） 攻击类型： 远程 影响： 远程命令执行 漏洞利用代码 POC： YouTube POC： https://youtu.be/D45FN8QrzDo 产品厂商： https://www.webmin.com 附加信息： “Webmin 是一种基于 Web 的系统管理工具，适用于类 Unix 服务器和服务，全球安装量超过...

CVE-2026-56018

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify, allowing unbounded memory growth. In JsMinify XS.xs the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes withou...

CVE-2026-45287

OpenTelemetry-Go (Go implementation) prior to version 0.0.17 leaks one file descriptor per successful ParseFile call when parsing go.opentelemetry.io/otel/schema/v1.0 and v1.1. In long-running processes, repeated schema parsing without proper file closure can exhaust the process file descriptor l...

go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak

A flaw was found in OpenTelemetry-Go before schema package version 0.0.17. ParseFile in go.opentelemetry.io/otel/schema/v1.0 and v1.1 opens a schema file and passes it to Parse without closing it, leaking one file descriptor per successful call. Repeated parsing in a long-running process can...

CVE-2021-31761

Webmin 1.973 is affected by reflected Cross Site Scripting XSS to achieve Remote Command Execution through Webmin's running process feature...

Beware of scammers impersonating Malwarebytes

Scammers love to bank on the good name of legitimate companies to gain the trust of their intended targets. Recently, it came to our attention that a cybercriminal is using fake websites for security products to spread malware. One of those websites was impersonating the Malwarebytes brand. Image...

CVE-2023-4480

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write fil...

CVE-2023-4480 Arbitrary File Read in Fusion File Manager

Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows them to read the contents of files on the system accessible within the privileges of the running process. Additionally, they may write fil...

SUSE Linux Enterprise Server 路径遍历漏洞

SUSE Linux Enterprise Server is a suite of enterprise server edition Linux operating systems from SUSE Germany. A path traversal vulnerability exists in SUSE Linux Enterprise Server. A remote attacker could use this vulnerability to read the files of a user running a process. The following produc...

CVE-2021-27570

An issue was discovered in Emote Remote Mouse through 3.015. Attackers can close any running process by sending the process name in a specially crafted packet. This information is sent in cleartext and is not protected by any authentication logic...

Authentication flaw

An issue was discovered in Emote Remote Mouse through 3.015. Attackers can close any running process by sending the process name in a specially crafted packet. This information is sent in cleartext and is not protected by any authentication logic...

Cross site request forgery (csrf)

Webmin 1.973 is affected by Cross Site Request Forgery CSRF to achieve Remote Command Execution RCE through Webmin's running process feature...

CVE-2021-31760

Webmin 1.973 is affected by Cross Site Request Forgery CSRF to achieve Remote Command Execution RCE through Webmin's running process feature...

CVE-2021-31761

Webmin 1.973 is affected by reflected Cross Site Scripting XSS to achieve Remote Command Execution through Webmin's running process feature...

DEBIAN-CVE-2019-14907

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" or above then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP...

CVE-2019-5029

An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded by backticks or $ can be inserted into the editor and will be executed by the Exhibitor process when it launches ZooKeeper. An attacker c...