CVE-2020-1947

CVE-2020-1947 ApacheShardingShpereUIYAML解析によるリモートコード実行脆弱性の再現と分析 概要 shardingsphereはapacheのオープンソースエコシステムであり、分散データベースミドルウェアソリューションのセットです。sharding-jdbc、sharding-proxy、sharding-sidecarという3つの独立したフレームワークで構成され、データシャーディング、分散トランザクション、データベースガバナンスを提供するために使用されます。 影響を受けるバージョン ShardingSphere 4.0.0-RC3, 4.0.0...

CVE-2020-1947

CVE-2020-1947 Apache ShardingSphere UI YAML解析リモートコード実行脆弱性の再現 0x01 shardingsphere バイナリパッケージのダウンロード wget https://mirror-hk.koddos.net/apache/incubator/shardingsphere/4.0.0/apache-shardingsphere-incubating-4.0.0-sharding-ui-bin.tar.gz 解凍 root@kali tar -xf...

CVE-2022-22733

CVE-2022-22733 CVE-2022-22733 は、Apache ShardingSphere ElasticJob-UI 3.0.0 以前のバージョンに影響を与える脆弱性であり、権限昇格 Privilege Escalation を引き起こします。しかし、昇格した権限を悪用することで JDBC 攻撃を実行し、RCE を達成することが可能です。脆弱性の分析はこちらから、エクスプロイト作成のステップバイステップのブログはこちらから読むことができます。 エクスプロイトは以下のように動作します: 低権限のアカウントでログインします。 安全でない方法で生成された accessToke...

ShardingSphere_CVE-2020-1947

此存储库没有 README。...

CVE-2022-31764

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of...

EUVD-2021-13357

Malware in sbrugna...

EUVD-2022-7763

Malicious code in bioql PyPI...

EUVD-2023-1936

Malicious code in bioql PyPI...

EUVD-2022-54255

Malicious code in bioql PyPI...

CVE-2023-28754

Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file. The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machin...

CVE-2022-22733

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and pri...

CVE-2022-45347

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apac...

CVE-2021-26558

Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0...

CVE-2020-1947

In Apache ShardingSphereincubator 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security...

The vulnerability of the Lite UI user interface library used in Apache ShardingSphere ElasticJob-UI for task scheduling arises from an internal index assignment error. This error allows attackers to gain unauthorized access to protected information.

The vulnerability of the Lite UI user interface library used in the Apache ShardingSphere ElasticJob-UI task scheduling software is related to an error in the assignment of the internal interface index. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...

CVE-2022-31764

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of...

CVE-2022-31764 Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of...

CVE-2022-31764 Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of...

CVE-2022-31764

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of...

CVE-2022-31764 Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2. The premise of...