Archive
29 May 2021
Vulnerabilities first published on this day (UTC), newest first.
6 results · Feed
-
Critical 9.8
Dragonfly contains remote code execution vulnerability
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because t…
-
Unscored —
Frontier ichris through 5.18 allows users to upload malicious executable files that might later be downloaded and run b…
-
Unscored —
Frontier ichris through 5.18 mishandles making a DNS request for the hostname in the HTTP Host header, as demonstrated …
-
Unscored —
A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used…
-
Critical 9.8
Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dub…
-
Critical 9.8
Dubbo Zookeeper does not check serialization id
Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byt…