VulnCheck KEV: CVE-2024-39891

Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy...

CVE-2024-39891

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and...

PT-2024-5376 · Twilio · Twilio Authy Android +2

Name of the Vulnerable Software and Affected Versions: Twilio Authy Android versions prior to 25.1.0 Twilio Authy iOS versions prior to 26.1.0 Description: The issue concerns an unauthenticated endpoint in the Twilio Authy API that provided access to certain phone-number data. This endpoint...

PT-2024-18089 · Unknown · Electrolink Fm/Dab/Tv Transmitter

Name of the Vulnerable Software and Affected Versions: Electrolink FM/DAB/TV Transmitter affected versions not specified Description: The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file system module provides ...

CVE-2023-46237 FOG path traversal via unauthenticated endpoint

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their...

CVE-2023-46236 FOG SSRF via unauthenticated endpoint(s)

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery SSRF vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote...

PT-2023-4951 · Triangle Microworks · Scada Data Gateway

Name of the Vulnerable Software and Affected Versions: Triangle MicroWorks SCADA Data Gateway affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations due to missing authentication. The specific flaw exists within...

Acronis Agent 安全漏洞

Acronis Agent is an agent software from Acronis Singapore. A security vulnerability exists in Acronis Agent versions prior to 30161 that originates from an unauthenticated API endpoint and can be exploited by an attacker to cause a denial of service...

CVE-2022-27897

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server...

CVE-2022-27892

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service...

CVE-2022-27891

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected servic...

CVE-2022-27891

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected servic...

CVE-2022-27892

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service...

CVE-2022-27897

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server...

Design/Logic Flaw

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected servic...

Code injection

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service...

CVE-2022-27892

Palantir Gotham versions prior to 3.22.11.2 are affected by an unauthenticated endpoint that can exhaust the Gotham dispatch service memory. The issue is triggered by an endpoint that accepts unvalidated input to log or process arbitrary payloads, enabling memory exhaustion on the Gotham dispatch...

Palantir 输入验证错误漏洞

Palantir is a data platform from US-based Palantir that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in Palantir Gotham versions prior to 3.22.11.2, which stems from the inclusion of an...

CVE-2022-27892 Palantir Gotham included an endpoint that would log arbitrary sized payloads.

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service...

PT-2023-12921 · Palantir · Palantir Gotham

Name of the Vulnerable Software and Affected Versions: Palantir Gotham versions prior to 103.30221005.0 Description: The issue concerns an unauthenticated endpoint in Palantir Gotham that lists all active usernames on the stack with an active session. The affected services have been patched and...