60506 matches found
SecLeak
SecLeak Assessment This repository contains the s...
Improper Cryptographic Key Management
Apache StreamPark is vulnerable to Improper Cryptographic Key Management. The vulnerability is due to using the user’s password directly as the HMAC signing key for JWTs, which allows an attacker to brute-force passwords offline or forge valid tokens to impersonate users and take over accounts...
Vega cross-site scripting vulnerabilities
Vega is a Javscript-based software from the Vega team that can be used to create interactive visual displays. The software can describe data visualizations using JSON format and generate interactive views using HTML5 Canvas or SVG. A cross-site scripting vulnerability exists in Vega versions prio...
Vega cross-site scripting vulnerabilities
Vega is a Javscript-based software from the Vega team that can be used to create interactive visual displays. The software can describe data visualizations using JSON format and generate interactive views using HTML5 Canvas or SVG. A cross-site scripting vulnerability exists in Vega versions prio...
defacemeter
DefaceMeter DefaceMeter is a small, static, browser-based pro...
CVE-2025-15284 vulnerabilities
Vulnerabilities for packages: langfuse, tileserver-gl, saf, thingsboard, code-server, kubeflow-centraldashboard, sqlpad, kubeflow-katib, renovate, kubeflow-pipelines, opensearch-dashboards, jupyter-base-notebook, json-server, py3-jupyterlab...
GHSA-6RW7-VPXM-498P vulnerabilities
Vulnerabilities for packages: langfuse, tileserver-gl, saf, thingsboard, code-server, kubeflow-centraldashboard, sqlpad, kubeflow-katib, renovate, kubeflow-pipelines, opensearch-dashboards, jupyter-base-notebook, json-server, py3-jupyterlab...
CVE-2025-15284 vulnerabilities
Vulnerabilities for packages: saf, argo-workflows, langfuse-fips, gitlab-rails-ce-fips, redisinsight, opensearch-dashboards-fips, tileserver-gl, tensorflow-gpu-jupyter, thingsboard, opensearch-dashboards, code-server, librechat, wazuh-dashboard-fips, jupyter-base-notebook, tileserver-gl-fips,...
CVE-2025-68620
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated...
GHSA-FQ56-HVG6-WVM5 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
SignalK Server exposes two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. Unauthenticated WebSocket Request Enumeration: When ...
EUVD-2025-206136
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling...
GHSA-W3X5-7C4C-66P9 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Summary An unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files e.g., security.json,...
CVE-2025-68620
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated...
Apache StreamPipes has Improper Privilege Management issue
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...
GHSA-5R2G-VPHF-M5XC Apache StreamPipes has Improper Privilege Management issue
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...
Incorrect Authorization
Overview streampipes is a Python library for Apache StreamPipes Affected versions of this package are vulnerable to Incorrect Authorization via the user ID creation mechanism. A user can gain administrative privileges by manipulating JWT tokens and swapping the username of an existing user with a...
CVE-2025-68620 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated...
CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...
CVE-2025-47411
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...
CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...