GO-2022-0855 Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server

Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server...

GO-2022-0852 Integer Overflow or Wraparound in NATS Server in github.com/nats-io/nats-server

Integer Overflow or Wraparound in NATS Server in github.com/nats-io/nats-server...

GO-2022-0398 Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server

Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server...

GO-2022-0351 Arbitrary file write in nats-server in github.com/nats-io/nats-server

Arbitrary file write in nats-server in github.com/nats-io/nats-server...

GO-2022-0307 Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server

Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server...

GO-2023-2066 NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server

NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server...

GO-2024-2980 NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server...

Authentication Bypass

github.com/nats-io/nats-server is vulnerable to Authentication bypass. The vulnerability is due to a failure to enforce negative user permissions in one scenario. Attackers can exploit this by using a queue subscription on the wildcard to access denied subjects...

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

DEBIAN-CVE-2022-29946

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

CVE-2022-29946

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

UBUNTU-CVE-2022-29946

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

PT-2024-11549 · Unknown · Nats Server +1

Name of the Vulnerable Software and Affected Versions: NATS Server versions prior to 2.8.2 NATS Streaming Server versions prior to 0.24.6 Description: The issue is caused by the failure to enforce negative user permissions in one scenario, allowing a remote attacker to bypass security restriction...

CVE-2022-29946: Undefined Security Weakness

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

NATS Server Security Vulnerability

NATS Server is an open source messaging system. The system is primarily used for cloud-native applications, IoT messaging, and microservices architectures. NATS.io A security vulnerability exists in NATS Server versions prior to 2.8.2 and Streaming Server versions prior to 0.24.6, which stems fro...

CVE-2022-29946

NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by the failure to enforce negative user permissions in one scenario. By using a queue subscription on the wildcard, an attacker could exploit this vulnerabilit...

CBL Mariner 2.0 Security Update: telegraf (CVE-2023-47090)

The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-47090 advisory. - NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user ...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: tekton-chains-fips, logstash-exporter-fips, kubernetes-dashboard, dask-gateway, dockerize, wavefront-collector-for-kubernetes, cilium-cli, src-fingerprint-fips, metallb, newrelic-nri-kube-events, cortex-fips, neuvector-sigstore-interface-fips, hubble-ui-backend-fips,...

GO-2024-2850 NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server

NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server...

Improper TLS Ciphers Configuration

github.com/nats-io/nats-server/ is vulnerable to Improper TLS Ciphers Configuration. The vulnerability is due to the loss of restricted ciphersuite settings when using CLI options to set a key/cert for TLS, enabling all ciphersuites supported by Go by default...