CVE-2023-49804

Summary: CVE-2023-49804 affects Uptime Kuma and precedes version 1.23.9. When a user changes their login password, a previously logged-in user remains authenticated and can access the platform, an issue that persists across system/browser restarts. This vulnerability can expose sensitive data due...

CVE-2023-49804

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

Uptime Kuma Security Vulnerability

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from Louis Lam Personal Developer. A security vulnerability exists in versions prior to Uptime Kuma 1.23.9 that stems from the application using WebSocket, but it does not validate that the communication source is valid, which would allow...

Uptime Kuma License Issue Vulnerability

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from Louis Lam Personal Developer. An authorization issue vulnerability exists in Uptime Kuma versions prior to 1.23.9, which stems from a lack of session token validation after a password change or after an inactivity period, whereby whe...

CVE-2023-49805: Missing Origin Validation in WebSockets

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...

PT-2023-31363 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.9 Description: Uptime Kuma is a self-hosted monitoring tool that uses WebSocket with Socket.io. Prior to version 1.23.9, the application does not verify the source of communication, allowing third-party...

CVE-2023-49804: Session Fixation

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

CVE-2023-49276

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

Cross site scripting

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276 Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276

CVE-2023-49276 affects Uptime Kuma (open-source self-hosted monitoring tool). The vulnerability arises from an attribute injection in the Google Analytics element due to unsanitized template usage, enabling Cross-Site Scripting (XSS) when a custom Google Analytics ID is set via the status interfa...

CVE-2023-49276 Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276: Improper Neutralization of Input During Web Page Generation

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

Uptime Kuma Cross-Site Scripting Vulnerability

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from Louis Lam Personal Developer. A cross-site scripting vulnerability exists in Uptime Kuma versions prior to 1.23.7, which stems from the presence of a property injection vulnerability that makes it susceptible to cross-site scripting...

Command Injection

uptime-kuma is vulnerable to Command Injection. The vulnerability is caused due to the application including hostname parameter inside a shell command. Attacker can inject OS commands in the hostname parameter leading to command injection...

Remote Code Execution (RCE)

uptime-kuma is vulnerable to Remote Code Execution RCE. The vulnerability is due to input validation for the hostname field being solely implemented on the client-side front-end JavaScript code which means that an attacker can circumvent the validation by modifying the HTML code of the input fiel...

GHSA-HFXH-RJV7-2369 Uptime Kuma Authenticated remote code execution via TailscalePing

Summary The runTailscalePing method of the TailscalePing class injects the hostname parameter inside a shell command, leading to a command injection and the possibility to run arbitrary commands on the server. Details When adding a new monitor on Uptime Kuma, we can select the "Tailscale Ping"...

Uptime Kuma Authenticated remote code execution via TailscalePing

Summary The runTailscalePing method of the TailscalePing class injects the hostname parameter inside a shell command, leading to a command injection and the possibility to run arbitrary commands on the server. Details When adding a new monitor on Uptime Kuma, we can select the "Tailscale Ping"...

PT-2023-33027 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma affected versions not specified Description: The issue concerns a command injection vulnerability in Uptime Kuma. Specifically, the runTailscalePing method of the TailscalePing class injects the hostname parameter inside a shell...