888 matches found
ZZCMS 跨站脚本漏洞
ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v.2023 and prior versions, which stems from a phpinfo function that discloses detailed information about the PHP environment, including server configuration, loaded modules, a...
CVE-2024-44820
CVE-2024-44820 affects ZZCMS v.2023 and earlier. The vulnerability resides in the eginfo.php file located at /3/E_bak5.1/upload/ and is triggered when phome=ShowPHPInfo is supplied, executing phpinfo() and exposing detailed PHP environment information (server config, loaded modules, variables). T...
Nuuo Central Management Server Authenticated Arbitrary File Download
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nuuo Central Management Server Authenticated Arbitrary File Download', 'Description' = %q The Nuuo Central Management Server allows an...
GO-2022-0838 Exposure of server configuration in github.com/go-vela/server in github.com/go-vela/compiler
Exposure of server configuration in github.com/go-vela/server in github.com/go-vela/compiler...
CVE-2024-37382
An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafted modification of server configuration...
CVE-2024-37382
An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafted modification of server configuration...
undertow: LearningPushHandler can lead to remote memory DoS attacks
A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the...
CVE-2024-37382
Affected products: Ab Initio Metadata Hub and Ab Initio Authorization Gateway, prior to version 4.3.1.1. Root cause: in the import host feature, crafted server configuration changes allow remote code execution. Impact: arbitrary code execution with high confidentiality, integrity, and availabilit...
PT-2024-27511 · Ab Initio · Ab Initio Authorization Gateway +1
Name of the Vulnerable Software and Affected Versions: Ab Initio Metadata Hub and Authorization Gateway versions prior to 4.3.1.1 Description: An issue in the import host feature allows attackers to run arbitrary code via crafted modification of server configuration. Recommendations: For versions...
CVE-2024-37382
An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafted modification of server configuration...
Ab Initio Metadata Hub和Ab Initio Authorization Gateway 安全漏洞
Ab Initio Metadata Hub and Ab Initio Authorization Gateway are both products of Ab Initio, Inc. of the U.S. Ab Initio Metadata Hub is a metadata system.Ab Initio Authorization Gateway is an authorization gateway. A security vulnerability exists in Ab Initio Metadata Hub and Ab Initio Authorizatio...
SUSE CVE-1999-0184
When compiled with the -DALLOWUPDATES option, bind allows dynamic updates to the DNS server, allowing for malicious modification of DNS records...
The vulnerability of the GLPI-Agent, a system agent for requests, incidents, and inventory management of computer equipment, arises due to insufficient validation of input data. This vulnerability allows attackers to trigger service failures or increase their privileges.
The vulnerability of the GLPI-Agent, a system agent for requests, incidents, and computer equipment inventory, exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to cause service failures or increase their privileges by configuring the server wi...
lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
CVE-2024-5824
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
CVE-2024-5824
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
CVE-2024-5824 Path Traversal in parisneo/lollms
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
CVE-2024-5824
CVE-2024-5824 affects parisneo/lollms 9.4.0. A path traversal issue in the /set_personality_config endpoint can overwrite configs/config.yaml, enabling remote code execution by altering server configuration properties such as force_accept_remote_access and turn_on_code_validation. Public exploit ...
CVE-2024-5824 Path Traversal in parisneo/lollms
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
