Alibaba kayıtları
alibaba üreticisine ait 12 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 2
- Düzeltme kaydı olan
- %50
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer1
- CWE-190 Integer Overflow or Wraparound1
- CWE-20 Improper Input Validation1
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-287 Improper Authentication1
- CWE-290 Authentication Bypass by Spoofing1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWEBug bounty kapsamı
Ürünün üreticisi herkese açık bir programda görünüyor. Eşleşme ad üzerinden yapıldı; kapsam metnini programda doğrulayın.
Tüm kayıtlar
12 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
64Bu hafta | CVE-2021-29441Kavram kanıtı | Authentication bypassalibaba · nacos · CWE-290 | Kritik9,8 | — | %83,5 | 27 Nis 2021 |
51Planlayın | CVE-2017-18349Kavram kanıtı | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbipippo · pippo · CWE-20 | Kritik9,8 | — | %39,2 | 23 Eki 2018 |
50Planlayın | CVE-2021-29442Kavram kanıtı | Authentication bypassalibaba · nacos · CWE-306 | Yüksek7,5 | — | %65,7 | 27 Nis 2021 |
45Planlayın | CVE-2022-25845Kavram kanıtı | Deserialization of Untrusted Dataalibaba · fastjson · CWE-502 | Kritik9,8 | — | %18,7 | 10 Haz 2022 |
37İzleyin | CVE-2021-43116Kavram kanıtı | An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packalibaba · nacos · CWE-287 | Yüksek8,8 | — | %7,5 | 5 Tem 2022 |
33İzleyin | CVE-2024-44067İstismar yok | The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivilegedCWE-119 | Yüksek8,4 | — | %0,2 | 18 Ağu 2024 |
30İzleyin | CVE-2021-33800İstismar yok | In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.alibaba · druid · CWE-22 | Yüksek7,5 | — | %1,5 | 3 Kas 2021 |
30İzleyin | CVE-2020-21699İstismar yok | The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in thealibaba · tengine · CWE-190 | Yüksek7,5 | — | %0,8 | 22 Ağu 2023 |
28İzleyin | CVE-2007-0827Kavram kanıtı | The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that invalibaba · alipay activex control | Orta6,8 | — | %4,3 | 7 Şub 2007 |
24İzleyin | CVE-2021-44667Kavram kanıtı | A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.alibaba · nacos · CWE-79 | Orta6,1 | — | %0,8 | 11 Mar 2022 |
21İzleyin | CVE-2020-19676İstismar yok | Nacos 1.1.4 is affected by: Incorrect Access Control.alibaba · nacos | Orta5,3 | — | %1,4 | 30 Eyl 2020 |
21İzleyin | CVE-2014-5976İstismar yok | The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows manalibaba · alibaba · CWE-310 | Orta5,4 | — | %0,3 | 20 Eyl 2014 |
- CVE-2021-2944164Bu hafta
Authentication bypass
KritikCVSS 9,8Kavram kanıtıEPSS %83alibaba · nacos27 Nis 2021
- CVE-2017-1834951Planlayın
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbi
KritikCVSS 9,8Kavram kanıtıEPSS %39pippo · pippo23 Eki 2018
- CVE-2021-2944250Planlayın
Authentication bypass
YüksekCVSS 7,5Kavram kanıtıEPSS %66alibaba · nacos27 Nis 2021
- CVE-2022-2584545Planlayın
Deserialization of Untrusted Data
KritikCVSS 9,8Kavram kanıtıEPSS %19alibaba · fastjson10 Haz 2022
- CVE-2021-4311637İzleyin
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture pack
YüksekCVSS 8,8Kavram kanıtıEPSS %7alibaba · nacos5 Tem 2022
- CVE-2024-4406733İzleyin
The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged
YüksekCVSS 8,4İstismar yokEPSS %018 Ağu 2024
- CVE-2021-3380030İzleyin
In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.
YüksekCVSS 7,5İstismar yokEPSS %2alibaba · druid3 Kas 2021
- CVE-2020-2169930İzleyin
The web server Tengine 2.2.2 developed in the Nginx version from 0.5.6 thru 1.13.2 is vulnerable to an integer overflow vulnerability in the
YüksekCVSS 7,5İstismar yokEPSS %1alibaba · tengine22 Ağu 2023
- CVE-2007-082728İzleyin
The Alibaba Alipay PTA Module ActiveX control (PTA.DLL) allows remote attackers to execute arbitrary code via a JavaScript function that inv
OrtaCVSS 6,8Kavram kanıtıEPSS %4alibaba · alipay activex control7 Şub 2007
- CVE-2021-4466724İzleyin
A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
OrtaCVSS 6,1Kavram kanıtıEPSS %1alibaba · nacos11 Mar 2022
- CVE-2020-1967621İzleyin
Nacos 1.1.4 is affected by: Incorrect Access Control.
OrtaCVSS 5,3İstismar yokEPSS %1alibaba · nacos30 Eyl 2020
- CVE-2014-597621İzleyin
The alibaba (aka com.alibaba.wireless) application 4.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man
OrtaCVSS 5,4İstismar yokEPSS %0alibaba · alibaba20 Eyl 2014