Search
Find a vulnerability
Search criteria
4 vulnerabilities by ln-lab
CVE-2024-28033 (GCVE-0-2024-28033)
Vulnerability from nvd – Published: 2024-03-26 09:34 – Updated: 2024-08-02 17:11
VLAI
EPSS
VEX
Summary
OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy 1.7.8 and 1.7.9.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-02 17:06 UTC
CWE
- OS command injection
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jvn.jp/en/jp/JVN22376992/ |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| LunarNight Laboratory | WebProxy |
Affected:
1.7.8
|
|
| LunarNight Laboratory | WebProxy |
Affected:
1.7.9
|
|
| ln-lab | webproxy |
Affected:
1.7.8
cpe:2.3:a:ln-lab:webproxy:1.7.8:*:*:*:*:*:*:* |
|
| ln-lab | webproxy |
Affected:
1.7.9
cpe:2.3:a:ln-lab:webproxy:1.7.9:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:47.724Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN22376992/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ln-lab:webproxy:1.7.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webproxy",
"vendor": "ln-lab",
"versions": [
{
"status": "affected",
"version": "1.7.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:ln-lab:webproxy:1.7.9:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webproxy",
"vendor": "ln-lab",
"versions": [
{
"status": "affected",
"version": "1.7.9"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-28033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-02T17:06:16.130736Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-02T17:11:00.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WebProxy",
"vendor": "LunarNight Laboratory",
"versions": [
{
"status": "affected",
"version": "1.7.8"
}
]
},
{
"product": "WebProxy",
"vendor": "LunarNight Laboratory",
"versions": [
{
"status": "affected",
"version": "1.7.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy 1.7.8 and 1.7.9."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-26T09:34:07.760Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://jvn.jp/en/jp/JVN22376992/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-28033",
"datePublished": "2024-03-26T09:34:07.760Z",
"dateReserved": "2024-03-05T04:06:08.243Z",
"dateUpdated": "2024-08-02T17:11:00.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-3255 (GCVE-0-2008-3255)
Vulnerability from nvd – Published: 2008-07-22 16:00 – Updated: 2024-08-07 09:28
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in LunarNight Laboratory WebProxy 1.7.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/30283 | vdb-entryx_refsource_BID |
| http://jvn.jp/en/jp/JVN49704543/index.html | third-party-advisoryx_refsource_JVN |
| http://secunia.com/advisories/31042 | third-party-advisoryx_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.ln-lab.net/lunar-night.lab/page-dl_web… | x_refsource_CONFIRM |
Date Public
2008-07-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:28:42.037Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "30283",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30283"
},
{
"name": "JVN#49704543",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN49704543/index.html"
},
{
"name": "31042",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31042"
},
{
"name": "lunarnight-webproxy-unspecified-xss(43879)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43879"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ln-lab.net/lunar-night.lab/page-dl_webproxy/design-whiteecuni"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in LunarNight Laboratory WebProxy 1.7.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "30283",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30283"
},
{
"name": "JVN#49704543",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN49704543/index.html"
},
{
"name": "31042",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31042"
},
{
"name": "lunarnight-webproxy-unspecified-xss(43879)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43879"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ln-lab.net/lunar-night.lab/page-dl_webproxy/design-whiteecuni"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3255",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in LunarNight Laboratory WebProxy 1.7.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "30283",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30283"
},
{
"name": "JVN#49704543",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN49704543/index.html"
},
{
"name": "31042",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31042"
},
{
"name": "lunarnight-webproxy-unspecified-xss(43879)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43879"
},
{
"name": "http://www.ln-lab.net/lunar-night.lab/page-dl_webproxy/design-whiteecuni",
"refsource": "CONFIRM",
"url": "http://www.ln-lab.net/lunar-night.lab/page-dl_webproxy/design-whiteecuni"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3255",
"datePublished": "2008-07-22T16:00:00.000Z",
"dateReserved": "2008-07-22T00:00:00.000Z",
"dateUpdated": "2024-08-07T09:28:42.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28033 (GCVE-0-2024-28033)
Vulnerability from cvelistv5 – Published: 2024-03-26 09:34 – Updated: 2024-08-02 17:11
VLAI
EPSS
VEX
Summary
OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy 1.7.8 and 1.7.9.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-02 17:06 UTC
CWE
- OS command injection
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://jvn.jp/en/jp/JVN22376992/ |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| LunarNight Laboratory | WebProxy |
Affected:
1.7.8
|
|
| LunarNight Laboratory | WebProxy |
Affected:
1.7.9
|
|
| ln-lab | webproxy |
Affected:
1.7.8
cpe:2.3:a:ln-lab:webproxy:1.7.8:*:*:*:*:*:*:* |
|
| ln-lab | webproxy |
Affected:
1.7.9
cpe:2.3:a:ln-lab:webproxy:1.7.9:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:47.724Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN22376992/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ln-lab:webproxy:1.7.8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webproxy",
"vendor": "ln-lab",
"versions": [
{
"status": "affected",
"version": "1.7.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:ln-lab:webproxy:1.7.9:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "webproxy",
"vendor": "ln-lab",
"versions": [
{
"status": "affected",
"version": "1.7.9"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-28033",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-02T17:06:16.130736Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-02T17:11:00.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WebProxy",
"vendor": "LunarNight Laboratory",
"versions": [
{
"status": "affected",
"version": "1.7.8"
}
]
},
{
"product": "WebProxy",
"vendor": "LunarNight Laboratory",
"versions": [
{
"status": "affected",
"version": "1.7.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy 1.7.8 and 1.7.9."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-26T09:34:07.760Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://jvn.jp/en/jp/JVN22376992/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-28033",
"datePublished": "2024-03-26T09:34:07.760Z",
"dateReserved": "2024-03-05T04:06:08.243Z",
"dateUpdated": "2024-08-02T17:11:00.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-3255 (GCVE-0-2008-3255)
Vulnerability from cvelistv5 – Published: 2008-07-22 16:00 – Updated: 2024-08-07 09:28
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in LunarNight Laboratory WebProxy 1.7.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/30283 | vdb-entryx_refsource_BID |
| http://jvn.jp/en/jp/JVN49704543/index.html | third-party-advisoryx_refsource_JVN |
| http://secunia.com/advisories/31042 | third-party-advisoryx_refsource_SECUNIA |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.ln-lab.net/lunar-night.lab/page-dl_web… | x_refsource_CONFIRM |
Date Public
2008-07-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:28:42.037Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "30283",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30283"
},
{
"name": "JVN#49704543",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN49704543/index.html"
},
{
"name": "31042",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31042"
},
{
"name": "lunarnight-webproxy-unspecified-xss(43879)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43879"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ln-lab.net/lunar-night.lab/page-dl_webproxy/design-whiteecuni"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in LunarNight Laboratory WebProxy 1.7.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "30283",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30283"
},
{
"name": "JVN#49704543",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN49704543/index.html"
},
{
"name": "31042",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31042"
},
{
"name": "lunarnight-webproxy-unspecified-xss(43879)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43879"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ln-lab.net/lunar-night.lab/page-dl_webproxy/design-whiteecuni"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3255",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in LunarNight Laboratory WebProxy 1.7.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "30283",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30283"
},
{
"name": "JVN#49704543",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN49704543/index.html"
},
{
"name": "31042",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31042"
},
{
"name": "lunarnight-webproxy-unspecified-xss(43879)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43879"
},
{
"name": "http://www.ln-lab.net/lunar-night.lab/page-dl_webproxy/design-whiteecuni",
"refsource": "CONFIRM",
"url": "http://www.ln-lab.net/lunar-night.lab/page-dl_webproxy/design-whiteecuni"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3255",
"datePublished": "2008-07-22T16:00:00.000Z",
"dateReserved": "2008-07-22T00:00:00.000Z",
"dateUpdated": "2024-08-07T09:28:42.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}