Versa Concerto API Path Based - Authentication Bypass

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. id: CVE-2025-34027 info:...

Versa Concerto Actuator Endpoint - Authentication Bypass

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

Versa Concerto API Path Based - Authentication Bypass Detection

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. !/usr/bin/env python3 --...

Versa Concerto Actuator Endpoint - Authentication Bypass Detection

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

7ghost (>=4.11.0, <=4.11.46), @accordproject/concerto-ui-react (>=0.6.0-alpha.1, <=0.83.1-20200224151908) +271 more potentially affected by CVE-2025-61140 via jsonpath (>=1.0.0, <=1.1.1)

jsonpath NPM version =1.0.0, =4.11.0, =0.6.0-alpha.1, =0.82.10-20200221024018, =1.0.0, =1.1.0-dev.2, =3.0.6371, =4.0.2, =2.0.4, =0.2.0-dev.1, =4.0.149, =3.0.129, =4.0.174, =0.11.8, =1.2.5, =1.4.0 and more Source cves: CVE-2025-61140 Source advisory: OSV:GHSA-6C59-MWGH-R2X6...

CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added four security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2025-68645 CVSS score: 8.8 - A PHP remote fi...

Versa Concerto Improper Authentication Vulnerability

Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs...

CVE-2021-31930

Persistent cross-site scripting XSS in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the...

EUVD-2025-199346

Malicious code in @accordproject/concerto-types npm...

Malware in @accordproject/concerto-types

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @accordproject/concerto-metamodel

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-199347

Malicious code in @accordproject/concerto-metamodel npm...

MAL-2025-191174 Malicious code in @accordproject/concerto-metamodel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1581131b6f7d752a2f26c167db5c144e33b737febc23f3e156f76a1b68e763ae The package @accordproject/concerto-metamodel was found to contain malicious code. Source: ghsa-malware...

Malware in @accordproject/concerto-linter-default-ruleset

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-199348

Malicious code in @accordproject/concerto-linter-default-ruleset npm...

MAL-2025-191173 Malicious code in @accordproject/concerto-linter-default-ruleset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9f48c313afcaf0a201a7b16889d968e2694c7e3751cc334b257de8f8084d9df The package @accordproject/concerto-linter-default-ruleset was found to contain malicious code. Source: ghsa-malware...

Malware in @accordproject/concerto-linter

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @accordproject/concerto-linter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a266ef73fe4cd4e7227a57de2c97b342daf2ae0aed81e06b41bd9a55ab02d24 The package @accordproject/concerto-linter was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199349

Malicious code in @accordproject/concerto-linter npm...

MAL-2025-191172 Malicious code in @accordproject/concerto-linter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a266ef73fe4cd4e7227a57de2c97b342daf2ae0aed81e06b41bd9a55ab02d24 The package @accordproject/concerto-linter was found to contain malicious code. Source: ghsa-malware...