CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-21699
https://notcve.org/view.php?id=CVE-2020-21699
The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the nginx range filter module, resulting in the leakage of potentially sensitive information triggered by specially crafted requests. • https://github.com/ZxDecide/Nginx-variants/blob/master/%E9%99%84%E4%BB%B6%28Tengine%29.docx • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.8EPSS: 6%CPEs: 1EXPL: 3CVE-2021-43116 – Nacos 2.0.3 - Access Control vulnerability
https://notcve.org/view.php?id=CVE-2021-43116
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login. Se presenta una vulnerabilidad de control de acceso en Nacos versiones 2.0.3, en la página access prompt; ingrese el nombre de usuario y la contraseña, haga clic en iniciar sesión para capturar paquetes y luego cambie el paquete devuelto, lo que permite a un usuario malicioso iniciar sesión Nacos version 2.0.3 suffers from an access control vulnerability. • https://www.exploit-db.com/exploits/51205 http://packetstormsecurity.com/files/171638/Nacos-2.0.3-Access-Control.html https://github.com/alibaba/nacos/issues/7127 https://github.com/alibaba/nacos/issues/7182 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 2CVE-2022-25845 – Deserialization of Untrusted Data
https://notcve.org/view.php?id=CVE-2022-25845
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode). El paquete com.alibaba:fastjson versiones anteriores a 1.2.83, es vulnerable a una Deserialización de Datos No Confiables al omitir las restricciones de cierre de autoType por defecto, lo cual es posible bajo determinadas condiciones. La explotación de esta vulnerabilidad permite atacar servidores remotos. • https://github.com/nerowander/CVE-2022-25845-exploit https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15 https://github.com/alibaba/fastjson/releases/tag/1.2.83 https://github.com/alibaba/fastjson/wiki/security_update_20220523 https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222 https://www.ddosi.org/fastjson-poc https://www.oracle.com/security-alerts/cpujul2022.html https://access.redhat.com/security • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-44667
https://notcve.org/view.php?id=CVE-2021-44667
A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters. Se presenta una vulnerabilidad de tipo Cross Site Scripting (XSS) en Nacos versión 2.0.3, en auth/users por medio de los parámetros (1) pageSize y (2) pageNo • https://github.com/alibaba/nacos/issues/7359 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33800
https://notcve.org/view.php?id=CVE-2021-33800
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. En Druid versión 1.2.3, la visita a la ruta con parámetro en una determinada función puede conllevar a un salto de directorio • https://security.alibaba.com/announcement/announcement?id=214 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •