ocsinventory-ng ocs inventory server vulnerabilities and exploits

(subscribe to this query)

NA

Multiple unspecified vulnerabilities in the Server component in OCS Inventory NG prior to 1.02 have unknown impact and attack vectors.

Ocsinventory-ng Ocs Inventory Ng 1.0 Ocsinventory-ng Ocs Inventory Ng

1 EDB exploit

8.8

CVSSv3

Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server up to and including 2.5 allows a privileged user to gain access to the server via a template file containing PHP code, because file ex...

Ocsinventory-ng Ocs Inventory Server

8.8

CVSSv3

OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues.

Ocsinventory-ng Ocsinventory Ng 2.4.1

9.1

CVSSv3

OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in order to exfiltrate information or cause a Denial of Service.

Ocsinventory-ng Ocsinventory Ng 2.4.1

8.8

CVSSv3

OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscover_analyser rzo GET parameter is concatenated to a string used in an exec() call in the PHP code. Authentication is needed in order to expl...

Ocsinventory-ng Ocsinventory Ng 2.4.1

8.8

CVSSv3

Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests.

Ocsinventory-ng Ocsinventory Ng -

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook