Advisories · Technology
dromara lamp-cloud.
Every CVE that names dromara lamp-cloud among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
- dromara lamp-cloud
- Broken access control
- CVSS 7.1 High
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
- dromara lamp-cloud
- Broken access control
- CVSS 5.3 Medium
lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource
- dromara lamp-cloud
- Broken access control
- CVSS 7.1 High
lamp-cloud through 5.10.0 Unauthorized Notification Deletion
- dromara lamp-cloud
- Broken access control
- CVSS 7.1 High
lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
- dromara lamp-cloud
- Broken access control
- CVSS 7.1 High
lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
- dromara lamp-cloud
- Broken access control
- CVSS 7.1 High
lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
- dromara lamp-cloud
- Broken access control
- CVSS 8.7 High
lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
- dromara lamp-cloud
- Authentication bypass
- CVSS 6.9 Medium
dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal
- dromara lamp-cloud
- Path traversal
- CVSS 6.9 Medium
Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal
- Dromara lamp-cloud
- Path traversal
- CVSS 5.3 Medium
Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal
- Dromara lamp-cloud
- Path traversal
- CVSS 8.7 High
LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution
- dromara lamp-cloud
- Code injection
- CVSS 5.3 Medium
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
- Dromara lamp-cloud
- Code injection
- CWE-791
- CVSS 5.3 Medium
Dromara lamp-cloud DefUserController pageUser improper authorization
- Dromara lamp-cloud
- Privilege escalation
- Broken access control