Hummerrisk
Monthly
Server-Side Request Forgery in HummerRisk up to version 1.5.0 allows a high-privileged authenticated attacker to manipulate the streamIp argument within the ServerService.addServer function of the Video File Download URL Handler (ServerService.java), causing the server to issue arbitrary HTTP requests to internal or external destinations. All versions from 1.0 through 1.5.0 are confirmed affected, the vendor did not respond to responsible disclosure, and no patch is available. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% and SSVC classification of non-automatable indicate limited broad-exploitation risk at this time.
HummerRisk versions up to 1.5.0 contain a path traversal vulnerability in the archive extraction functionality that allows authenticated remote attackers to read and write arbitrary files on the system. Public exploit code exists for this vulnerability, and no patch is currently available. The vulnerability affects the extractTarGZ and extractZip functions in the common utilities library.
Hummerrisk versions up to 1.5.0. contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Command injection in HummerRisk up to version 1.5.0 allows authenticated remote attackers to execute arbitrary commands through the Cloud Task Dry-run feature by manipulating the fileName parameter in CloudTaskService.java. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. An attacker with valid credentials can achieve remote code execution with limited impact on confidentiality, integrity, and availability.
HummerRisk versions up to 1.5.0 contain a command injection vulnerability in the Cloud Task Scheduler component where the regionId parameter is insufficiently validated, allowing authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability and the vendor has not provided a patch despite early disclosure notification. An authenticated attacker can exploit this to achieve remote code execution with limited scope impact.
HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.
Server-Side Request Forgery in HummerRisk up to version 1.5.0 allows a high-privileged authenticated attacker to manipulate the streamIp argument within the ServerService.addServer function of the Video File Download URL Handler (ServerService.java), causing the server to issue arbitrary HTTP requests to internal or external destinations. All versions from 1.0 through 1.5.0 are confirmed affected, the vendor did not respond to responsible disclosure, and no patch is available. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% and SSVC classification of non-automatable indicate limited broad-exploitation risk at this time.
HummerRisk versions up to 1.5.0 contain a path traversal vulnerability in the archive extraction functionality that allows authenticated remote attackers to read and write arbitrary files on the system. Public exploit code exists for this vulnerability, and no patch is currently available. The vulnerability affects the extractTarGZ and extractZip functions in the common utilities library.
Hummerrisk versions up to 1.5.0. contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Command injection in HummerRisk up to version 1.5.0 allows authenticated remote attackers to execute arbitrary commands through the Cloud Task Dry-run feature by manipulating the fileName parameter in CloudTaskService.java. Public exploit code exists for this vulnerability, and the vendor has not released a patch despite early notification. An attacker with valid credentials can achieve remote code execution with limited impact on confidentiality, integrity, and availability.
HummerRisk versions up to 1.5.0 contain a command injection vulnerability in the Cloud Task Scheduler component where the regionId parameter is insufficiently validated, allowing authenticated remote attackers to execute arbitrary commands. Public exploit code exists for this vulnerability and the vendor has not provided a patch despite early disclosure notification. An authenticated attacker can exploit this to achieve remote code execution with limited scope impact.
HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.