225 matches found
CVE-2023-22496-PoC
CVE-2023-22496 — Netdata Agent OS Command Injection PoC Severity : Critical CVSS 9.8 Affected : Netdata Agent Fixed in : v1.37.0 Type : OS Command Injection CWE-78 Overview CVE-2023-22496 is an OS command injection vulnerability in Netdata's health alarm notification system. The registryhostname ...
CVE-2026-110110 JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...
CVE-2026-110110
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fixed an off-by-one buffer overflow in alarmsstore. The sysfs buffer passed to alarmsstore is allocated with ‘size + 1’ bytes, and a NUL terminator is appended. However, the ‘size’ argument does not account for this...
CVE-2025-70340: Improper Access Control
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...
CVE-2025-59180 Use of Hard-coded Credentials Vulnerability
Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...
PT-2026-64918
Ericsson Packet Core Controller PCC versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information...
Millions of cars could be tracked and unlocked by a hidden security flaw
A car alarm vendor's coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don't even know they have one installed. The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm buil...
A Device Hidden in Cars Across the US Leaves Them Vulnerable to Hacking and Paralysis. Patch It Now
Dealerships installed alarms in millions of vehicles—and left them in even if the buyer didn’t want them. Now researchers warn they can be hacked to unlock, track, and disable cars...
BARS: Benign-Anchored Ranking and Selection for False Alarm Reduction in Network Intrusion Detection
False alarms remain a major barrier to deploying network intrusion detection systems NIDS. In high-volume environments, even a sub-1% false positive rate can generate tens of thousands of daily alerts. Filter-based feature selection is attractive because it operates upstream of the classifier and...
GNSS Spoofing Detection in TDD Networks: A 3GPP Standards-Based Security Framework
Time Division Duplex TDD mobile networks require synchronization accuracy of $\pm$1.5 $μ$s 3GPP TS 38.104, with GNSS-disciplined grandmaster clocks as the predominant timing source. GNSS spoofing -- now a documented operational threat -- can corrupt timing across all downstream base stations, yet...
CVE-2026-56120
Affected software: OpenRemote before 1.25.0.Vulnerability: insecure direct object reference (IDOR) in the bulk alarm deletion endpoint.Root cause: removeAlarms() in AlarmResourceImpl.java omits realm-scoping validation in the JPA query, enabling any user with alarm-write permissions to enumerate ...
Improper Export of Android Application Components
Overview Affected versions of this package are vulnerable to Improper Export of Android Application Components via the LocationSensorManager BroadcastReceiver process. An attacker can manipulate zone-based automations by sending a forged location result, causing unauthorized actions such as...
CVE-2026-56784
OpenRemote before 1.25.0 contains an insecure direct object reference IDOR vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms method in AlarmResourceImpl.java...
EUVD-2026-38444
OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong ...
CVE-2026-56784
OpenRemote Manager before 1.24.2 contains an insecure direct object reference in removeAlarms(), enabling authenticated users to delete alarms across tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint does not validate that IDs belong to the caller’s realm, enabling cross-tenant...
etcd: etcd: Authorization bypass allows information disclosure and denial of service
A flaw was found in etcd, a distributed key-value store. Unauthorized users can bypass authentication or authorization checks when the gRPC API is exposed to untrusted clients. This allows them to access sensitive cluster topology information, disrupt operations through alarms, interfere with lea...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the removeAlarms process. An attacker can permanently delete alarm records belonging to other tenants by supplying arbitrary alarm IDs in a bulk delete request. This can result in...
PT-2026-51517
Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.25.0 Description An insecure direct object reference IDOR exists in the bulk alarm deletion endpoint. The removeAlarms function in AlarmResourceImpl.java fails to perform realm-scoping validation in its JPA query...