Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2016-10529

EPSS 0.13% · P33
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2016-10529

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Droppy versions <3.5.0 does not perform any verification for cross-domain websocket requests. An attacker is able to make a specially crafted page that can send requests as the context of the currently logged in user. For example this means the malicious user could add a new admin account under his control and delete others.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨站请求伪造(CSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Droppy 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Droppy是一款自托管的文件存储服务器，它支持在浏览器中查看媒体文件。 Droppy 3.5.0之前版本中存在安全漏洞，该漏洞源于程序没有验证跨域的websocket请求。攻击者可借助特制的网站发送请求利用该漏洞执行任意操作（例如：删除其他用户）。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
HackerOnedroppy node module <3.5.0 -

II. Public POCs for CVE-2016-10529

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2016-10529

Please Login to view more intelligence information

Same Patch Batch · HackerOne · 2018-05-31 · 50 CVEs total

CVE-2016-10550sequalize SQL注入漏洞
CVE-2016-10560galenframework-cli 安全漏洞
CVE-2016-10564apk-parser 安全漏洞
CVE-2016-10565operadriver 安全漏洞
CVE-2016-10569embedza 安全漏洞
CVE-2016-10571bkjs-wand 安全漏洞
CVE-2016-10572mongodb-instance 安全漏洞
CVE-2016-10563go-ipfs-deps模块安全漏洞
CVE-2016-10553sequalize SQL注入漏洞
CVE-2016-10552igniteui 安全漏洞
CVE-2016-10554sequelize 安全漏洞
CVE-2016-10549Sails 安全漏洞
CVE-2016-10548reduce-css-calc node模块安全漏洞
CVE-2016-10547Nunjucks 安全漏洞
CVE-2016-10546PouchDB 安全漏洞
CVE-2016-10544uws 安全漏洞
CVE-2016-10543call 安全漏洞
CVE-2016-10542ws 安全漏洞
CVE-2016-10541Thshell-quote 安全漏洞
CVE-2016-10540Minimatch 安全漏洞

Showing top 20 of 50 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same vendor: HackerOne
Same weakness: CWE-352

V. Comments for CVE-2016-10529

No comments yet

Leave a comment