Nils Emmerich

3 exploits Active since Jul 2019
CVE-2024-33531 WRITEUP HIGH WRITEUP
cdbattags lua-resty-jwt 0.2.3 - Authentication Bypass via JWT enc Header Spoofing
cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM.
CVSS 8.1
CVE-2019-9848 METASPLOIT CRITICAL ruby WORKING POC
LibreOffice < 6.2.5 - Remote Code Execution via LibreLogo Python Command Injection
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
CVSS 9.8
CVE-2019-9851 EXPLOITDB CRITICAL ruby WORKING POC
LibreOffice - Code Injection
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
CVSS 9.8