64 matches found
CVE-2024-28211
nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker...
CVE-2024-28214
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker...
Deserialization of untrusted data
nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization...
Server side request forgery (ssrf)
nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
Design/Logic Flaw
nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker...
Denial of service
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker...
Server side request forgery (ssrf)
nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28216
CVE-2024-28216 affects nGrinder prior to 3.5.9. The root cause is lack of access control, allowing an attacker to obtain webhook results and potentially cause information disclosure and limited Server-Side Request Forgery. Affected versions: before 3.5.9. Remediation: update to 3.5.9 or later; as...
CVE-2024-28216
nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28216
nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28215
CVE-2024-28215 affects nGrinder prior to 3.5.9. The issue arises from lack of access control, allowing an attacker to create or update webhook configurations, which could lead to information disclosure and limited Server-Side Request Forgery. Affected installations should upgrade to version 3.5.9...
CVE-2024-28215
nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28215
nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28214
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker...
CVE-2024-28214
The CVE describes a vulnerability in nGrinder before 3.5.9 where the delay setting can be configured without an upper limit, enabling a remote attacker to cause a Denial of Service. Affected software: nGrinder (prior to 3.5.9). Root cause: unbounded delay configuration leading to DoS. Impact: Den...
CVE-2024-28214
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker...
CVE-2024-28213
CVE-2024-28213 concerns nGrinder pre-3.5.9, where the application accepts serialized Java objects from unauthenticated users, enabling unsafe Java object deserialization that could lead to remote code execution. Affected software: nGrinder versions before 3.5.9. Root cause: lack of input filterin...
CVE-2024-28213
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization...
CVE-2024-28213
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization...