CVE-2023-49566

In Apache Linkis =1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to obta...

PT-2022-20493 · Kctf · Kctf

Name of the Vulnerable Software and Affected Versions: kCTF versions prior to 1.6.0 Description: The kCTF cluster set-src-ip-ranges feature was broken, allowing traffic from any IP. This issue has been patched in version 1.6.0. As a workaround for private challenge testing, users can mark...