43 matches found
EUVD-2026-94522
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...
PT-2026-107590
Name of the Vulnerable Software and Affected Versions Homer versions prior to 11.0.283 Description The V4StatisticsQuery handler fails to call the sqlvalidator.ValidateRawSQL function when processing the user-supplied rawquery field, passing it directly to DuckDB. This allows an authenticated use...
PT-2026-107592
Name of the Vulnerable Software and Affected Versions Homer versions prior to 11.0.283 Description In default installations, the software fails to enforce authentication for protected API endpoints because the jwtSecret variable defaults to an empty string. When this variable is empty, the...
PT-2026-107591
Name of the Vulnerable Software and Affected Versions Homer versions prior to 11.0.283 Description In fresh deployments using internal authentication, the bootstrap process automatically creates an admin account with a hard-coded password sipcapture. This password is stored as a legacy SHA-256 he...
CVE-2022-22845-Exploit
CVE-2022-22845-Exploit CVE-2022-22845 익스플로잇 - QXIP SIPCAPTURE Homer-App 1.4.27까지의 인증되지 않은 관리자 탈취 발견: Omri Baso & Fabien Aunay 익스플로잇 제작자: Omri Baso...
EUVD-2025-33521
Malicious code in redirect-homer-flajpt npm...
Malicious code in redirect-homer-flajpt (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2502cef083844b1d28d0a2144019b1d0b6ab5552c1941ac61177134782ac8519 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview redirect-homer-flajpt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malware in redirect-homer-flajpt
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2025-48169 Malicious code in redirect-homer-flajpt (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2502cef083844b1d28d0a2144019b1d0b6ab5552c1941ac61177134782ac8519 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-34753
A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller 5200WHC2, formerly known as C-Bus Wiser Homer Controlle...
CVE-2022-22845
QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations...
Code injection
QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations...
Homer WebApp 信任管理问题漏洞
Homer WebApp is an open source Go Web application hosting the Homer-AppHep/Homer 7.7+ stack from Sipcapture in the Netherlands. A security vulnerability exists in Homer WebApp 7.x before 1.4.28, which stems from the QXIP SIPCAPTURE homer-app having the same 167f0db2-f83e-4baa-9736-d56064a5b415 JW...
CVE-2022-22845
QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations...
CVE-2022-22845
CVE-2022-22845 affects QXIP SIPCAPTURE homer-app (HOMER 7.x) before 1.4.28. Reported issue: the JWT secret key 167f0db2-f83e-4baa-9736-d56064a5b415 is reused across different customer installations, enabling insecure session handling. Impact described as high severity with potential unauthorized ...
