Oaklouds-webbase-2.0 CVEs and Security Vulnerabilities

CVE-2024-26261

Hgiga OAKlouds - Arbitrary File Read And Delete

The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hgiga

Products

Oaklouds-organization-2.0 Oaklouds-organization-3.0 Oaklouds-webbase-2.0 and 1 more

CVE-2024-26260

Hgiga OAKlouds - Command Injection

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed