anji-plus records

10 published records for vendor anji-plus.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 10%
Median publish → KEV: No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

10 records

CVE records
Action	CVE	Vulnerability	Severity	EPSS · Published
55Plan	CVE-2024-7314Proof of concept	anji-plus AJ-Report Authentication Bypassanji-plus · report · CWE-288 pre-auth RCE Auth bypass	Critical9.8	51.7%Aug 2, 2024
39Monitor	CVE-2022-46973No exploit	Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.anji-plus · aj-report · CWE-918 Pre-auth SSRF	Critical9.8	0.8%Mar 3, 2023
36Monitor	CVE-2022-42983No exploit	anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.anji-plus · aj-report · CWE-290 Auth bypass	High8.8	1.7%Oct 17, 2022
22Monitor	CVE-2024-5355No exploit	anji-plus AJ-Report IGroovyHandler command injectionanji-plus · aj-report · CWE-77 RCE Command injection	Medium5.3	3.1%May 26, 2024
21Monitor	CVE-2024-5356Proof of concept	anji-plus AJ-Report testTransform;swagger-ui sql injectionanji-plus · aj-report · CWE-89 SQL injection	Medium5.3	1.0%May 26, 2024
21Monitor	CVE-2024-5353No exploit	anji-plus AJ-Report ZIP File decompress path traversalanji-plus · aj-report · CWE-22 Path traversal	Medium5.3	0.8%May 26, 2024
21Monitor	CVE-2024-5352No exploit	anji-plus AJ-Report validationRules deserializationanji-plus · aj-report · CWE-502 Deserialization	Medium5.3	0.7%May 25, 2024
21Monitor	CVE-2024-5351No exploit	anji-plus AJ-Report Javascript getValueFromJs deserializationanji-plus · aj-report · CWE-502 Deserialization	Medium5.3	0.7%May 25, 2024
21Monitor	CVE-2024-5354No exploit	anji-plus AJ-Report detailByCode information disclosureanji-plus · aj-report · CWE-200 Info leak	Medium5.3	0.6%May 26, 2024
21Monitor	CVE-2024-5350No exploit	anji-plus AJ-Report pageList sql injectionanji-plus · aj-report · CWE-89 SQL injection	Medium5.3	0.5%May 25, 2024

CVE-2024-7314
55Plan
anji-plus AJ-Report Authentication Bypass
CriticalCVSS 9.8Proof of conceptEPSS 51%
- pre-auth RCE
- Auth bypass
anji-plus · reportAug 2, 2024
CVE-2022-46973
39Monitor
Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SSRF
anji-plus · aj-reportMar 3, 2023
CVE-2022-42983
36Monitor
anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
HighCVSS 8.8No exploitEPSS 1%
- Auth bypass
anji-plus · aj-reportOct 17, 2022
CVE-2024-5355
22Monitor
anji-plus AJ-Report IGroovyHandler command injection
MediumCVSS 5.3No exploitEPSS 3%
- RCE
- Command injection
anji-plus · aj-reportMay 26, 2024
CVE-2024-5356
21Monitor
anji-plus AJ-Report testTransform;swagger-ui sql injection
MediumCVSS 5.3Proof of conceptEPSS 1%
- SQL injection
anji-plus · aj-reportMay 26, 2024
CVE-2024-5353
21Monitor
anji-plus AJ-Report ZIP File decompress path traversal
MediumCVSS 5.3No exploitEPSS 0%
- Path traversal
anji-plus · aj-reportMay 26, 2024
CVE-2024-5352
21Monitor
anji-plus AJ-Report validationRules deserialization
MediumCVSS 5.3No exploitEPSS 0%
- Deserialization
anji-plus · aj-reportMay 25, 2024
CVE-2024-5351
21Monitor
anji-plus AJ-Report Javascript getValueFromJs deserialization
MediumCVSS 5.3No exploitEPSS 0%
- Deserialization
anji-plus · aj-reportMay 25, 2024
CVE-2024-5354
21Monitor
anji-plus AJ-Report detailByCode information disclosure
MediumCVSS 5.3No exploitEPSS 0%
- Info leak
anji-plus · aj-reportMay 26, 2024
CVE-2024-5350
21Monitor
anji-plus AJ-Report pageList sql injection
MediumCVSS 5.3No exploitEPSS 0%
- SQL injection
anji-plus · aj-reportMay 25, 2024