CVE-2021-20050

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data...

org.apereo.cas:cas-server-support-shell (5.2.0-rc2), org.apereo.cas:cas-server-webapp (>=5.2.0-rc2, <=5.2.6) +3 more potentially affected by CVE-2025-3986 via org.apereo.cas:cas-server-core-configuration-metadata-repository (>=5.2.0-rc2, <=5.2.6)

org.apereo.cas:cas-server-core-configuration-metadata-repository MAVEN version =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.6 Source cves: CVE-2025-3986 Source advisory: OSV:GHSA-MVWQ-HCRJ-F5X9...

org.apereo.cas:cas-server-support-shell (5.2.0-rc2), org.apereo.cas:cas-server-webapp (>=5.2.0-rc2, <=5.2.6) +3 more potentially affected by CVE-2025-3986 via org.apereo.cas:cas-server-core-configuration-metadata-repository (>=5.2.0-rc2, <=5.2.6)

org.apereo.cas:cas-server-core-configuration-metadata-repository MAVEN version =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.0-rc2, =5.2.6 Source cves: CVE-2025-3986 Source advisory: GHSA-MVWQ-HCRJ-F5X9...

org.apereo.cas:cas-server-webapp (6.0.0-rc4), org.apereo.cas:cas-server-webapp-jetty (6.0.0-rc4) +2 more potentially affected by CVE-2025-3986 via org.apereo.cas:cas-server-core-configuration-metadata-repository (6.0.0-rc4)

org.apereo.cas:cas-server-core-configuration-metadata-repository MAVEN version 6.0.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-configuration-metadata-repository and may be impacted: -...

Apereo CAS security vulnerabilities

Apereo CAS is a web-based enterprise multilingual single sign-on solution from Apereo open source. A security vulnerability exists in Apereo CAS version 5.2.6, which originates from the file cas-5.2.6corecas-server-core-configuration-metadata-repositorysrcmainjavaorgapereocasmetadata Parameter Na...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONTokener.nextValue

Detailed Report: https://oss-fuzz.com/testcase?key=6587677827203072 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONArray.writeTo

Detailed Report: https://oss-fuzz.com/testcase?key=5455267230711808 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

spring-boot:ConfigurationMetadataRepositoryJsonBuilderFuzzer: Security exception in org.json.JSONArray.writeTo

Detailed Report: https://oss-fuzz.com/testcase?key=4861338172915712 Project: spring-boot Fuzzing Engine: libFuzzer Fuzz Target: ConfigurationMetadataRepositoryJsonBuilderFuzzer Job Type: libfuzzerasanspring-boot Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

Improper Access Control

apachesuperset is vulnerable to Improper Access Control. The vulnerability exists in api.py due to explicitly enabling the DASHBOARDCACHE feature which allows an unauthenticated user to access dashboard configuration metadata using a rest api GET endpoint...

CVE-2021-20050

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data...

CVE-2021-20050

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data...

Improper access control

An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user login, potentially exposing configuration meta-data...

CVE-2021-20050

CVE-2021-20050 affects the SonicWall SMA100 series, where an improper access control vulnerability allows multiple restricted management APIs to be accessed without user authentication, potentially exposing configuration meta-data. The issue is documented across multiple sources (SonicWall PSIRT ...

Vulnerability fixed in SonicWall SMA100 series

A vulnerability has been fixed in SonicWall SMA100 series. The vulnerability allows an unauthenticated remote malicious person able to access some management APIs in order to view meta-data of configurations. SonicWall has released updates to fix the vulnerability. fix. More information can be...

org.apereo.cas:cas-server-core-configuration-metadata-repository (5.3.2), org.apereo.cas:cas-server-support-passwordless (5.3.2) +11 more potentially affected by CVE-2021-42567 via org.apereo.cas:cas-server-core-web (5.3.2)

org.apereo.cas:cas-server-core-web MAVEN version 5.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-web and may be impacted: - org.apereo.cas:cas-server-core-configuration-metadata-repository 5.3.2 -...

Stored XSS vulnerability in Config File Provider Plugin

Config File Provider Plugin did not escape configuration file metadata, resulting in a stored cross-site scripting XSS vulnerability. Config File Provider Plugin now escapes configuration file metadata shown on the Jenkins UI...