CVSS: 9.8EPSS: 5%CPEs: 1EXPL: 1CVE-2024-1198 – openBI Phar User.php addxinzhi deserialization
https://notcve.org/view.php?id=CVE-2024-1198
02 Feb 2024 — A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User.php of the component Phar Handler. The manipulation of the argument outimgurl leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/qFXZZfp1NLa3 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1117 – openBI Screen.php index code injection
https://notcve.org/view.php?id=CVE-2024-1117
31 Jan 2024 — A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /application/index/controller/Screen.php. The manipulation of the argument fileurl leads to code injection. The attack can be launched remotely. • https://note.zhaoj.in/share/Liu1nbjddxu4 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1116 – openBI Upload.php index unrestricted upload
https://notcve.org/view.php?id=CVE-2024-1116
31 Jan 2024 — A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller/Upload.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. • https://note.zhaoj.in/share/uCElTQRGWVyw • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1115 – openBI Setting.php dlfile os command injection
https://notcve.org/view.php?id=CVE-2024-1115
31 Jan 2024 — A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/81JmiyogcYL7 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1114 – openBI Screen.php dlfile access control
https://notcve.org/view.php?id=CVE-2024-1114
31 Jan 2024 — A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/controller/Screen.php. The manipulation of the argument fileUrl leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/9wv48TygKRxo • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1113 – openBI Unity.php uploadUnity unrestricted upload
https://notcve.org/view.php?id=CVE-2024-1113
31 Jan 2024 — A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/controller/Unity.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/hPSx8li8LFfJ • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2024-1036 – openBI Icon Screen.php uploadIcon unrestricted upload
https://notcve.org/view.php?id=CVE-2024-1036
30 Jan 2024 — A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon of the file /application/index/controller/Screen.php of the component Icon Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/X1ASzPP5rHel • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1035 – openBI Icon.php uploadIcon unrestricted upload
https://notcve.org/view.php?id=CVE-2024-1035
30 Jan 2024 — A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function uploadIcon of the file /application/index/controller/Icon.php. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/AIbnbytIW9Bq • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1034 – openBI File.php uploadFile unrestricted upload
https://notcve.org/view.php?id=CVE-2024-1034
30 Jan 2024 — A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/controller/File.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/ABYkFE4wRPW5 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1033 – openBI Datament.php agent information disclosure
https://notcve.org/view.php?id=CVE-2024-1033
30 Jan 2024 — A vulnerability, which was classified as problematic, has been found in openBI up to 1.0.8. Affected by this issue is the function agent of the file /application/index/controller/Datament.php. The manipulation of the argument api leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/nD654ot6zRQZ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •