436 matches found
InfluxDB-Exploit-CVE-2019-20933
InfluxDB Exploit CVE-2019-20933 Exploit for InfluxDB CVE-2019-20933 vulnerability, InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret. Exploit check if serv...
CVE-2024-30896
CVE-2024-30896 Summary A business logic flaw in influxdb allows users who own a valid allAccess token to escalate their privileges at operator level by listing current authorization tokens. Scenario Attacker might be a user which was gained access by an administrator via an allAccess token only...
InfluxDB <1.7.6 - Authentication Bypass
InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret aka shared secret. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...
CVE-2019-20933
CVE-2019-20933 InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret. see https://nvd.nist.gov/vuln/detail/CVE-2019-20933 For more details PoC This PoC exploit...
CVE-2019-20933
LAB 5-CVE-2019-20933 I. SYSTEM ANALYSIS Identifying the Attack Surface Starting with what is running in the environment. I list all active containers: docker ps The victim exposes a single port:8086. Currently, I do not have detailed information about the target. From the docker ps output, the...
CVE-2026-78663 affecting package influxdb for versions less than 2.7.5-22
CVE-2026-78663 affecting package influxdb for versions less than 2.7.5-22. A patched version of the package is available...
CVE-2026-78669 affecting package influxdb for versions less than 2.7.5-22
CVE-2026-78669 affecting package influxdb for versions less than 2.7.5-22. A patched version of the package is available...
CVE-2026-78659 affecting package influxdb for versions less than 2.7.5-22
CVE-2026-78659 affecting package influxdb for versions less than 2.7.5-22. A patched version of the package is available...
CVE-2026-97032 affecting package influxdb for versions less than 2.7.5-22
CVE-2026-97032 affecting package influxdb for versions less than 2.7.5-22. A patched version of the package is available...
AZL-107517 CVE-2026-97032 affecting package influxdb 2.7.5-21
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
AZL-107520 CVE-2026-78669 affecting package influxdb 2.7.5-21
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
AZL-107526 CVE-2026-78659 affecting package influxdb 2.7.5-21
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107529 CVE-2026-78660 affecting package influxdb for versions less than 2.7.5-21
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107523 CVE-2026-78663 affecting package influxdb 2.7.5-21
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
Exploit for Improper Authentication in Influxdata Influxdb
InfluxDB Empty JWT Secret Authentication Bypass CVE-2019-2093...
monasca-agent (1.1.20), rejected (>=3.12.0, <=3.19.9) +1 more potentially affected by CVE-2026-103261 via tornado (4.2.1)
tornado PYPI version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - monasca-agent 1.1.20 - rejected =3.12.0, =1.0.0, =1.4.0 Source cves: CVE-2026-103261 Source advisory: OSV:GHSA-3HV7-MJH2-FV65...
monasca-agent (1.1.20), rejected (>=3.12.0, <=3.19.9) +1 more potentially affected by CVE-2026-103262 +1 more via tornado (4.2.1)
tornado PYPI version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - monasca-agent 1.1.20 - rejected =3.12.0, =1.0.0, =1.4.0 Source cves: CVE-2026-103262, CVE-2026-49855 Source advisory: OSV:GHSA-CHX6-46F5-W4VP...
monasca-agent (1.1.20), rejected (>=3.12.0, <=3.19.9) +1 more potentially affected by CVE-2026-103263 via tornado (4.2.1)
tornado PYPI version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - monasca-agent 1.1.20 - rejected =3.12.0, =1.0.0, =1.4.0 Source cves: CVE-2026-103263 Source advisory: OSV:GHSA-C2M8-H5V5-343R...