Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...

GHSA-5V7C-XPFP-P65M Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...

EUVD-2026-97830

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. A specially crafted JPEG file can cause the JPEG parser in grub2 to incorrectly check the boundaries of its internal buffers, leading to an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is still a concer...

Astra Linux – vulnerability in openssh

In OpenSSH versions prior to 9.6, OS command injection may occur if a username or hostname contains shell metacharacters, and such names are referenced via expansion tokens in certain scenarios. For instance, an untrusted Git repository might contain a submodule with shell metacharacters in its...

Astra Linux – Vulnerability in Erlang

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server might allow an attacker to perform unauthenticated remote code execution RCE. By exploiting a flaw in the SSH protocol’s message handling, a malicious...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module that serves as a dependency without checking whether any other dependent modules are still loaded, leading to a “use-after-free” scenario. This could allow arbitrary code to be...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Add overflow check in sgxvalidateoffsetlength The sgxvalidateoffsetlength function validates “offset” and “length” arguments provided by user space; however, it lacked an overflow check on their addition. This check shou...

Astra Linux – vulnerability in Tomcat9

When using RemoteIpFilter on requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat versions 11.0.0-M1 through 11.0.0.-M2, 10.1.0-M1 through 10.1.5, 9.0.0-M1 through 9.0.71, and 8.5.0 through 8.5.85 failed t...

Astra Linux – vulnerability in Erlang

In Erlang/OTP versions prior to 23.3.4.15, 24.x prior to 24.3.4.2, and 25.x prior to 25.0.2, there is a Client Authentication Bypass that occurs under certain client-certification scenarios for SSL, TLS, and DTLS...

Astra Linux – Vulnerability in xorg-server

A vulnerability was discovered in X.Org. This security flaw arises because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges escalation on systems where the X server is running with privileged access, and may...

Astra Linux – Vulnerability in Intel Microcode

Improper buffer restrictions in the firmware of certain IntelR XeonR Processors with SGX enabled may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability in grub2

The GRUB2’s shimlock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules being loaded in GRUB2, thereby breaking the secure boot trust-chain...

Astra Linux – Vulnerability in Systemd

Before version 247, systemd does not properly prevent local privilege escalation for certain Sudo configurations. For example, plausible sudoers files may allow the execution of the “systemctl status” command. Specifically, systemd does not set LESSSECURE to 1, allowing other programs to be...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race The SGX EPC reclaimer ksgxd may reclaim the SECS EPC page for an enclave and set secs.epcpage to NULL. The SECS page is used for EAUG and ELDU in the SGX page fault...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2 Macs On Apple T2 Macs, when Linux attempts to read the db and dbx efi variables at early boot to load UEFI Secure Boot certificates, a page fault occurs in Apple firmwa...

Astra Linux – vulnerability in xorg-server

A heap buffer overflow flaw was found in the DisableDevice function within the X.Org server. This issue may result in an application crash or, under certain conditions, remote code execution in SSH X11 forwarding environments...

Astra Linux – vulnerability in Firefox and Thunderbird

By injecting a cookie containing certain special characters, an attacker on a shared subdomain that is not a secure context can set and thereby overwrite cookies from a secure context, resulting in session fixation and other attacks. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3...

Astra Linux – vulnerability in grub2

A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the USB device is providing valid values. If properly exploited, an attacker could trigger memory corruption, leading to arbitrary code executio...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, if the IMA appraisal method is used with the “imaappraiselog” boot parameter, lockdown can be circumvented using kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents the “imaappraiselog” parameter from being set during boot, but this does not cover...