64 matches found
CVE-2024-28211
nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker...
CVE-2024-28214
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker...
Design/Logic Flaw
nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker...
Server side request forgery (ssrf)
nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
Deserialization of untrusted data
nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization...
Server side request forgery (ssrf)
nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
Denial of service
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker...
CVE-2024-28216
The stress testing platform nGrinder is vulnerable in versions prior to 3.5.9 due to a lack of access control . This flaw allows an attacker to obtain the results of webhook requests , potentially resulting in information disclosure and limited Server-Side Request Forgery (SSRF) . To remediate th...
CVE-2024-28216
nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28216
nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28215
Versions of nGrinder prior to 3.5.9 are vulnerable to a security flaw caused by a lack of access control . This allows an attacker to create or update webhook configurations , which could result in information disclosure and limited Server-Side Request Forgery (SSRF) . To remediate this issue, it...
CVE-2024-28215
nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28215
nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery...
CVE-2024-28214
The stress testing platform nGrinder is vulnerable to a Denial of Service (DoS) condition in versions prior to 3.5.9 . The root cause is the ability to set unlimited latency/delay settings, which can be exploited by a remote attacker to exhaust resources. To remediate this issue, users should upd...
CVE-2024-28214
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker...
CVE-2024-28214
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker...
CVE-2024-28213
Versions of nGrinder prior to 3.5.9 are vulnerable to unsafe Java objects deserialization . The software accepts serialized Java objects from unauthenticated users , which could allow a remote attacker to execute arbitrary code . To remediate this issue, users should update to version 3.5.9 or la...
CVE-2024-28213
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization...