GoCD Information Disclosure

ThoughtWorks GoCD is an open source continuous integration and development software CI/CD used to build, deploy and test software projects. GoCD versions 20.6.x to 21.2.0 suffer from an information disclosure in its business continuity add-on. A remote and unauthenticated attacker can leverage th...

CKAN < 2.8.12 Shared Session Secret

The version of CKAN installed can be impacted by a shared session secret if the application is based on one of the CKAN Docker images and if the users didn't set a custom value via an environment variable. Note that the scanner has not tested for these issues but has instead relied only on the...

ActivityPub Protocol Detected

A ActivityPub json endpoint has been detected and is available as an attachment below. ActivityPub is a W3C recomended standard that provides a client to server API for creating, updating and deleting content, as well as a federated server to server API for delivering notifications and subscribin...

Joomla Plugins Detected

This is an informational notice that the scanner was able to detect one or more installed Joomla plugins. No source data...

Fortra GoAnywhere MFT < 7.1.2 Remote Code Execution

Fortra GoAnywhere MFT is a Managed File Transfer MFT solution helping organizations build both internal and external data transfer exchanges. GoAnyWhere MFT versions before 7.1.2 suffer from a deserialization vulnerability in the LicenseResponse servlet. By crafting a specific serialized object, ...

Drupal Plugins Detected

This is an informational notice that the scanner was able to detect one or more installed Drupal plugins. No source data...

CVE-2023-32321 CKAN remote code execution and private information access via crafted resource ids

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

CraftCMS Administration Panel Login Form Detected

CraftCMS Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

MinIO Information Disclosure

MinIO is a multi-cloud and open-source object storage framework. When deployed in cluster mode, MinIO versions starting with RELEASE.2021-08-31T05-46-54Z and prior to RELEASE.2023-0320T20-16-18Z suffer from an information disclosure vulnerability, exposing all environment variables, including...

CraftCMS User Enumeration

In default CraftCMS installation there is available methodology to enumerate user information. These CraftCMS users may then be used in brute-force attacks against CraftCMS login page to guess passwords. No source data...

Pprof Debug Files Detected

Pprof is a tool for visualization and analysis of profiling data. Output files may be located inside a hidden directory named debug/pprof/ & When exposed with the web application configuration, the files contained in this directory may expose sensitive information such as internal memory addresse...

CraftCMS DevMode Enabled

CraftCMS installed on the remote host is configured to operate in development mode devMode. While this environment can help speed up development of web applications, it can leak information about the underlying web applications. No source data...

WP Show Posts Plugin for WordPress < 1.1.4 Cross-Site Scripting

The WordPress WP Show Posts Plugin installed on the remote host is affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

AtroCore 代码问题漏洞

AtroCore is an open source data platform, data management and middleware software from AtroCore, Inc. A security vulnerability exists in AtroCore version 1.5.25 that stems from the presence of an unauthenticated file upload vulnerability...

Qwik < 0.21.0 Code Injection

Qwik in version 0.21.0 provides an extended serialization mechanism for exchanging data between the client and server. Through a specially crafted request on the endpoint /q-data.json, an unauthenticated attacker is able to inject code and execute arbitrary commands No source data...

Apache Tomcat 8.5.x < 8.5.86 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.86, 9.0.0-M1 prior to 9.0.72, 10.1.0-M1 prior to 10.1.6 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by an information disclosure due to the RemoteIpFilter. Note that the scanner has not attempted to...

Atlassian Jira 7.13.0 < 8.3.0 Xss Via Project Configuration

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.3.0. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the...

Atlassian Jira < 7.6.0 Xss In SearchRequest.xml Resource

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.6.0. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through...

Atlassian Jira 8.0.0 < 8.5.0 Csrf On Wallboard Endpoint

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to modify Wallboard settings via a Cross-site request forgery CSRF vulnerability. Note that...

Atlassian Jira < 8.5.4 Dos Through Gadget API

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 8.5.4 or 8.6.0 prior to 8.6.1. It is, therefore, affected by a vulnerability which permits remote attackers to make Jira unresponsive via repeated requests to a certai...