CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-11942 – Open-AudIT 3.2.2 Command Injection / SQL Injection
https://notcve.org/view.php?id=CVE-2020-11942
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections. Se detectó un problema en Open-AudIT versión 3.2.2. Se presentan múltiples inyecciones SQL. Open-AudIT version 3.2.2 suffers from OS command injection, arbitrary file upload, and remote SQL injection vulnerabilities. • https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0 https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilities • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-11943 – Open-AudIT 3.2.2 Command Injection / SQL Injection
https://notcve.org/view.php?id=CVE-2020-11943
An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload. Se detectó un problema en Open-AudIT versión 3.2.2. Hay una carga de archivos arbitrarios. Open-AudIT version 3.2.2 suffers from OS command injection, arbitrary file upload, and remote SQL injection vulnerabilities. • https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0 https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilities • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 39%CPEs: 1EXPL: 5CVE-2020-12078 – Open-AudIT Professional 3.3.1 Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-12078
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address. Se descubrió un problema en Open-AudIT versión 3.3.1. • https://github.com/mhaskar/CVE-2020-12078 https://github.com/84KaliPleXon3/CVE-2020-12078 http://packetstormsecurity.com/files/157477/Open-AudIT-Professional-3.3.1-Remote-Code-Execution.html https://gist.github.com/mhaskar/dca62d0f0facc13f6364b8ed88d5a7fd https://github.com/Opmantek/open-audit/commit/6ffc7f9032c55eaa1c37cf5e070809b7211c7e9a https://shells.systems/open-audit-v3-3-1-remote-command-execution-cve-2020-12078 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 1CVE-2020-11941 – Open-AudIT 3.2.2 Command Injection / SQL Injection
https://notcve.org/view.php?id=CVE-2020-11941
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery. Se descubrió un problema en Open-AudIT versión 3.2.2. Hay una inyección de Comandos del Sistema Operativo en Discovery. Open-AudIT version 3.2.2 suffers from OS command injection, arbitrary file upload, and remote SQL injection vulnerabilities. • http://packetstormsecurity.com/files/157476/Open-AudIT-3.2.2-Command-Injection-SQL-Injection.html https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0 https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilities • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2020-12261 – Open-AudIT 3.3.0 - Reflective Cross-Site Scripting (Authenticated)
https://notcve.org/view.php?id=CVE-2020-12261
Open-AudIT 3.3.0 allows an XSS attack after login. Open-AudIT versión 3.3.0, permite un ataque de tipo XSS después del inicio de sesión. Open-AudIT version 3.3.0 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/48516 http://packetstormsecurity.com/files/157401/Open-AudIT-3.3.0-Cross-Site-Scripting.html https://community.opmantek.com/display/OA/Errata+-+3.3.0+XSS+in+error+templates https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •