![]() In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. Xwiki commons is the common modules used by other XWiki top level projects. A patch is available in versions 5.5.2 and 6.2.1. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. User unable to upgrade may disable Gunuplot via the config option`_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`. These patches are available in the `2.4.2` release. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. ![]() ![]() ![]() OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB).
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |