Magnohost-Vulnerabilities-pentest

MagnoHost-pentest MagnoHost ホスティングプロバイダー & MeteorCloud インフラストラクチャに対するペネトレーションテスト。発見事項: 6台のサーバーで MariaDB が公開 CVSS 9.8、OmniDialer のデフォルト認証情報による完全アクセス、Wings CVE-2024-27102 9.9、Grafana の公開、DMARC スプーフィング。curlcffi + Python のみ。自動スキャナーはゼロ。 ターゲット情報 フィールド| 詳細 ---|--- ドメイン| magnohost.com.br /...

Magnohost-Vulnerabilities-pentest

MagnoHost 渗透测试 对 MagnoHost 托管提供商及 MeteorCloud 基础设施的渗透测试。发现：6 台服务器上 MariaDB 暴露（CVSS 9.8），OmniDialer 默认凭据导致完全访问，Wings CVE-2024-27102（9.9），Grafana 暴露，DMARC 欺骗。仅使用 curlcffi + Python。零自动化扫描器。 目标信息...

SUSE CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

SUSE CVE-2026-52856

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

SUSE CVE-2026-52857

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

CVE-2026-61617

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

EUVD-2026-66776

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617 Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617

Wings , the server control plane for the Pterodactyl game-server management panel, contains a disk-quota enforcement flaw in its SFTP write path (versions up to and including 1.13.2 ). Wings checks available disk space only once as a boolean when the write handle is opened—using a stale cached va...

PT-2026-82313

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

CVE-2026-61617: Allocation of Resources Without Limits or Throttling

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical...

GO-2026-6156 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings...

GO-2026-6158 Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...

GO-2026-6120 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted file.create permissions in github.com/pterodactyl/wings...

GO-2026-6159 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings...

Uncontrolled Resource Consumption

github.com/pterodactyl/wings is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded JSON, YAML, and XML configuration file parsers in parser.go processing oversized non-file parser configuration data, which allows an attacker to exhaust the Wings process memory...

Improper Input Validation

Wings is vulnerable to Improper Input Validation. The vulnerability is due to improper handling of malformed packets during the SFTP connection handshake, which allows an attacker to send a specially crafted SFTP packet that triggers a Go panic and causes the server to crash, resulting in a...

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...