396 matches found
CVE-2025-3261
CVE-2025-3261 entry is rejected/not used as stated; it does not represent an active vulnerability.
编号撤回
ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. A security vulnerability exists in ThingsBoard versions prior to 4.2.1, which stems from Image Gallery allowing the uploading of malicious SVG images, which could lead to ...
GHSA-HGRR-935X-PQ79 vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2025-61795 vulnerabilities
Vulnerabilities for packages: thingsboard...
GHSA-25QH-J22F-PWP8 vulnerabilities
Vulnerabilities for packages: trino, cassandra, nextflow, management-api-for-apache-cassandra-5.0, kserve-modelmesh, apache-nifi, apache-nifi-registry, cassandra-reaper, akhq, dependency-track, keycloak-config-cli, sonar-scanner-cli, thingsboard, zookeeper...
CVE-2025-11226 vulnerabilities
Vulnerabilities for packages: trino, cassandra, nextflow, management-api-for-apache-cassandra-5.0, kserve-modelmesh, apache-nifi, apache-nifi-registry, cassandra-reaper, akhq, dependency-track, keycloak-config-cli, sonar-scanner-cli, thingsboard, zookeeper...
GHSA-25QH-J22F-PWP8 vulnerabilities
Vulnerabilities for packages: cassandra-fips, ontop-fips, kayenta, knative-kafka-broker, thingsboard, kserve-modelmesh, kayenta-fips, zookeeper, management-api-for-apache-cassandra-4.1, localstack, cassandra, keycloak-config-cli, nextflow, zookeeper-fips, cassandra-reaper,...
CVE-2025-11226 vulnerabilities
Vulnerabilities for packages: cassandra-fips, ontop-fips, kayenta, knative-kafka-broker, thingsboard, kserve-modelmesh, kayenta-fips, zookeeper, management-api-for-apache-cassandra-4.1, localstack, cassandra, keycloak-config-cli, nextflow, zookeeper-fips, cassandra-reaper,...
CVE-2025-34282
ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...
CVE-2025-34281
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...
CVE-2025-41254 vulnerabilities
Vulnerabilities for packages: thingsboard...
GHSA-7FCH-4F2F-JCGM vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2025-41254 vulnerabilities
Vulnerabilities for packages: thingsboard...
GHSA-7FCH-4F2F-JCGM vulnerabilities
Vulnerabilities for packages: thingsboard...
ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature
ThingsBoard versions 4.2.1 contain a stored cross-site scripting XSS vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient...
GHSA-FPQ4-R87V-G246 ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature
ThingsBoard versions 4.2.1 contain a stored cross-site scripting XSS vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient...
EUVD-2025-34907
ThingsBoard versions 4.2.1 contain a stored cross-site scripting XSS vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient...
EUVD-2025-34906
ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...
CVE-2025-34281
ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...