Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2024-1115

openBI Setting.php dlfile os command injection

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function dlfile of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252473 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS 1.9% KEV · Not listed
Vendors
Openbi
Products
Openbi
CVE-2024-1117

openBI Screen.php index code injection

A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /application/index/controller/Screen.php. The manipulation of the argument fileurl leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252475.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Openbi
Products
Openbi
CVE-2024-1198

openBI Phar User.php addxinzhi deserialization

A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file application/controllers/User.php of the component Phar Handler. The manipulation of the argument outimgurl leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252696.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbi
Products
Openbi
CVE-2024-1116

openBI Upload.php index unrestricted upload

A vulnerability was found in openBI up to 1.0.8. It has been classified as critical. Affected is the function index of the file /application/plugins/controller/Upload.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-252474 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Openbi
Products
Openbi
CVE-2024-1114

openBI Screen.php dlfile access control

A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file /application/index/controller/Screen.php. The manipulation of the argument fileUrl leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252472.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openbi
Products
Openbi
CVE-2024-1113

openBI Unity.php uploadUnity unrestricted upload

A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /application/index/controller/Unity.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252471.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openbi
Products
Openbi
CVE-2024-1036

openBI Icon Screen.php uploadIcon unrestricted upload

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon of the file /application/index/controller/Screen.php of the component Icon Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252311.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Openbi
Products
Openbi