Rubikcuv5

CVE-2023-30253 NOMISEC HIGH WORKING POC

Dolibarr Erp/crm < 17.0.1 - OS Command Injection

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.

6 stars

CVSS 8.8

View Code

CVE-2018-10933 NOMISEC CRITICAL WORKING POC

libssh Authentication Bypass Scanner

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

1 stars

CVSS 9.1

View Code

CVE-2023-25157 NOMISEC CRITICAL SCANNER

Osgeo Geoserver < 2.18.7 - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.

CVSS 9.8

View Code

CVE-2023-2825 NOMISEC CRITICAL WORKING POC

GitLab Authenticated File Read

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

CVSS 10.0

View Code