GHSA-VRPQ-QP53-QV56 vulnerabilities

Vulnerabilities for packages: nextflow, thingsboard, wildfly, apicurio-registry, apache-nifi-registry, gradle, sonarqube-10...

CVE-2024-9358

A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component HTTP RPC API. The manipulation leads to resource consumption. The attack can be launched remotely. The complexity of an attack is...

CVE-2024-3270

A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...

CVE-2023-26462

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

CVE-2022-48341

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

CVE-2022-40004

Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...

CVE-2022-45608

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers CUSTOMERUSER to gain escalated privileges vertically and become an Administrator TENANTADMIN or SYSADMIN on the web application. It is important to note that in order to accomplish this, the attacker must know the...

CVE-2025-31650 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-FF77-26X5-69CR vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-3P2H-WQQ4-WF4H vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2025-31651 vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2025-31651 vulnerabilities

Vulnerabilities for packages: thingsboard, camunda-zeebe...

GHSA-FF77-26X5-69CR vulnerabilities

Vulnerabilities for packages: thingsboard, camunda-zeebe...

CVE-2025-31650 vulnerabilities

Vulnerabilities for packages: thingsboard, camunda-zeebe...

GHSA-3P2H-WQQ4-WF4H vulnerabilities

Vulnerabilities for packages: thingsboard, camunda-zeebe...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-55466

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-55466

The ThingsBoard IoT platform (Community, Cloud, and Professional editions) is vulnerable to an arbitrary file upload vulnerability in the Image Gallery feature (version 3.8.1 and below ). While some descriptions suggest arbitrary code execution, detailed research reveals the root cause is Stored ...

CVE-2024-55466: Improper Neutralization of Special Elements used in a Command

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file...