Skip to content
Threat Feed
Subscribe

Vendor

Dromara

4 briefs RSS
high advisory

Multiple Vulnerabilities in Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net

Multiple unauthenticated vulnerabilities were disclosed across Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net, including XSS, information disclosure, and account takeover paths.

MaxKey +2
2t 4c
critical advisory

Unauthenticated Remote Code Execution in Dromara Skyeye

Dromara Skyeye contains a missing authentication vulnerability in its bundled xxl-job-admin JobInfoController, allowing unauthenticated attackers to execute arbitrary shell, Python, or PowerShell jobs on the executor host.

Skyeye remote-code-execution web-application-security
1r 3t 1c
high advisory

Hard-coded Cryptographic Key Vulnerability in Orion-visor

Orion-visor versions 2.5.7 and earlier contain a hard-coded cryptographic key within the HostKeyServiceImpl.encryptKey function, enabling potential remote compromise of encrypted host keys.

orion-visor vulnerability credential-exposure webserver
1t 1c
high advisory

Path Traversal in Dromara lamp-cloud

An unauthenticated remote path traversal vulnerability in Dromara lamp-cloud allows attackers to access unauthorized files via the FileAnyoneController component.

lamp-cloud
1r 1t 1c