CVE-2024-28872

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

CVE-2024-28872

The CVE-2024-28872 issue affects ISC Stork versions 0.15.0 through 1.15.0 and stems from flawed TLS certificate validation. An attacker could obtain a TLS certificate from the Stork server and use it to connect to the Stork agent, then issue malicious commands to monitored services (Kea or BIND 9...

CVE-2024-28872 Incorrect TLS certificate validation can lead to escalated privileges

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

CVE-2024-28872 Incorrect TLS certificate validation can lead to escalated privileges

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

kea-schipper.com Improper Access Control vulnerability OBB-3802564

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SUSE CVE-2019-6473

An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process kea-dhcp4, causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2...

SUSE CVE-2019-6474

A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea cod...

SUSE CVE-2019-6472

A packet containing a malformed DUID can cause the Kea DHCPv6 server process kea-dhcp6 to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2...

CVE-2021-46113

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service...

CVE-2021-46113

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service...

Remote code execution

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service...

CVE-2021-46113

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service...

CVE-2021-46113

CVE-2021-46113 affects MartDevelopers KEA-Hotel-ERP (open source). A remote code execution vulnerability is exploited via uploading PHP files through the service’s file upload feature. The issue is documented across multiple sources (NVD, CVE listing, CNNVD) and indicates RCE with potential unaut...

kea (>=0.1.0 <=0.1.3) potentially affected by CVE-2020-35885 via alpm-rs (=0.1.24)

alpm-rs CARGO version =0.1.24 is affected by a known vulnerability. The following packages have a transitive dependency on alpm-rs and may be impacted: - kea =0.1.0, =0.1.3 Source cves: CVE-2020-35885 Source advisory: OSV:GHSA-QC4M-GC8R-MG8M...

kea (>=0.1.0 <=0.1.3) potentially affected by CVE-2020-35885 via alpm-rs (=0.1.24)

alpm-rs CARGO version =0.1.24 is affected by a known vulnerability. The following packages have a transitive dependency on alpm-rs and may be impacted: - kea =0.1.0, =0.1.3 Source cves: CVE-2020-35885 Source advisory: OSV:RUSTSEC-2020-0032...

ISC Kea DHCP Input Validation Error Vulnerability

ISC Kea DHCP is an open source DHCP Dynamic Host Configuration Protocol server from ISC. An input validation error vulnerability exists in ISC Kea DHCP versions 1.4.0 through 1.5.0, 1.6.0-beta1 and 1.6.0-beta2. The vulnerability arises from the network system or product not properly validating...

CVE-2019-6474

A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea cod...

CVE-2019-6473

An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process kea-dhcp4, causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2...

CVE-2019-6472

A packet containing a malformed DUID can cause the Kea DHCPv6 server process kea-dhcp6 to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2...

ALPINE-CVE-2019-6473

An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process kea-dhcp4, causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2...