140 matches found
alibaba__nacos_CVE-2021-44667_2-0-3
Nacos: 동적 Na ming 및 Co nfiguration S ervice 기능 Nacos공식 사이트: nacos.io는 동적 서비스 디스커버리, 구성 및 서비스 관리를 위해 설계된 사용하기 쉬운 플랫폼입니다. 클라우드 네이티브 애플리케이션 및 마이크로서비스 플랫폼을 쉽게 구축할 수 있도록 도와줍니다. 서비스는 Nacos에서 일급 시민입니다. Nacos는 거의 모든 유형의 서비스를 지원합니다. 예를 들어 Dubbo/gRPC 서비스, Spring Cloud RESTFul 서비스 또는 Kubernetes 서비스 등이 있습니다...
CVE-2026-15316
An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the...
CVE-2026-15316
The Tapo C200 v5 configuration service lacks validation on encrypted credential ciphertext length, allowing an attacker on the local network to crash or restart the device by sending oversized values, temporarily disrupting HTTPS management and monitoring. CVSS 7.1 (HIGH), network-adjacent, no au...
PT-2026-78231
Name of the Vulnerable Software and Affected Versions Tapo C200 version v5 Description An improper input validation issue exists in the configuration service used for processing encrypted credential data. An attacker can send oversized crypted ciphertext values that trigger exception handling...
CVE-2026-15316: Improper Input Validation
An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the...
Improper Authentication
Apollo ConfigService is vulnerable to Improper Authentication. The vulnerability is due to improper validation of non-canonical appId values during authentication, which allows an attacker to bypass AccessKey or management key protections and gain unauthorized access to protected configuration da...
Exploit for OS Command Injection in Ivanti Standalone_Sentry
CVE-2026-10520 !Pythonhttps://img.shields.io/badge/Python...
CVE-2026-11469
A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to...
CVE-2026-35223
An improper access check allows unauthorized access to comconfig webservice endpoints...
Malicious code in @timelycare/config-service (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc893c48f00d7000b6737fbccd385652c78342aad49e12c49134ce72b42852a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2026-18432
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an...
CVE-2026-34121
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an...
CVE-2026-34121
TP-Link Tapo C520WS v2.6 is affected by an authentication bypass in the DS configuration service’s HTTP handling due to inconsistent JSON request parsing and authorization logic. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do action...
CVE-2026-34121 Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an...
CVE-2026-34121: Improper Authentication
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an...
TP-Link Tapo C520WS 安全漏洞
The TP-Link Tapo C520WS is a WiFi camera produced by TP-Link Corporation. The TP-Link Tapo C520WS v2.6 version has a security vulnerability. This vulnerability stems from inconsistencies in the JSON request parsing and authorization logic during the authentication check in the DS configuration...
PT-2026-29849
A critical HTTP authentication bypass CVE-2026-34121 has been identified in TP-Link devices, potentially allowing unauthorized access. Technical Breakdown Vulnerability Type: Authentication Bypass Impact: Allows an attacker to circumvent HTTP authentication mechanisms on affected TP-Link devices,...
CVE-2018-25126
Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware used by many white-labeled DVR/NVR/IPC products contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor...
CVE-2025-37160 Authenticated Broken Access Control (BAC) in REST API Configuration Service
A broken access control BAC vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data...
CVE-2025-37160
The CVE-2025-37160 entry describes a broken access control (BAC) vulnerability in the web-based management interface of HPE Aruba Networking AOS-CX. An authenticated remote attacker with low privileges could view sensitive information, leading to data disclosure. The affected component is the web...