|
Il servizio utilizza una raccolta di tweet provenienti da utenti appartenenti a Twitter i cui tweet utilizzano parole... |
Il servizio raccoglie informazioni relative ad exploit pubblici aggiornati giornalmente attraverso il repository... |
Un’ontologia rappresenta una risorsa per organizzare la conoscenza di un dominio in maniera più dettagliata attraverso... |
Il servizio offre una piattaforma che consente ai Registrar di verificare eventuali problemi di performance e sicurezza... |
| Published | Description | |
|---|---|---|
| CVE-2021-21248 |
15-01-2021 21:15:00 |
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input. |
| CVE-2021-21242 |
15-01-2021 21:15:00 |
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or authorization checks. This issue may lead to pre-auth remote code execution. This issue was fixed in 4.0.3 by removing AttachmentUploadServlet and not using deserialization |
| CVE-2021-21245 |
15-01-2021 21:15:00 |
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder. |
| CVE-2021-21249 |
15-01-2021 21:15:00 |
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized |
| CVE-2021-21247 |
15-01-2021 21:15:00 |
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserializes the `data` query parameter. We can access this listener by submitting a POST request to any page. This issue may lead to `post-auth RCE` This endpoint is subject to authentication and, therefore, requires a valid user to carry on the attack. This issue was addressed in 4.0.3 by encrypting serialization payload with secrets only known to server. |
| Date | Title | Platform | Author |
|---|---|---|---|
|
15-01-2021 |
E-Learning System 1.0 - Authentication Bypass & RCE POC | php | Himanshu Shukla |
|
15-01-2021 |
Online Hotel Reservation System 1.0 - 'id' Time-based SQL Injection | php | Mesut Cetin |
|
15-01-2021 |
Netsia SEBA+ 0.16.1 - Authentication Bypass and Add Root User (Metasploit) | multiple | AkkuS |
|
15-01-2021 |
Online Hotel Reservation System 1.0 - 'person' time-based SQL Injection | php | Mesut Cetin |
|
15-01-2021 |
Online Hotel Reservation System 1.0 - Cross-site request forgery (CSRF) | php | Mesut Cetin |
| Published | Title | URL |
|---|---|---|
| 13-01-2021 | Nuovo malware Android Rougue RAT (AL01/210113/CSIRT-ITA) | CERT LINK |
| 12-01-2021 | Nuova campagna mondiale di phishing/smishing (AL01/210112/CSIRT-ITA) | CERT LINK |
| 11-01-2021 | La Settimana Cibernetica del 10 gennaio 2021 | CERT LINK |
| 08-01-2021 | Vulnerabilità su dispositivi Netgear (AL03/210108/CSIRT-ITA) | CERT LINK |
| 08-01-2021 | Vulnerabilità su dispositivi Belkin (AL02/210108/CSIRT-ITA) | CERT LINK |
Italiano
English