90 matches found
CVE-2026-121260
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploi...
EUVD-2026-115917
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploi...
CVE-2026-121260: Ziroom ZHOME A0101: A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploi...
CVE-2026-59387
The Cloud Foundry Controller (CAPI) , specifically versions up to and including v1.245.0 , contains a broken access control restriction in its Nginx routing configuration. While internal endpoints for /internal/v4/ and /internal/v5/ are protected, the configuration omits a deny rule for /internal...
CVE-2026-59387 Broken access control restriction in Cloud Controller API
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...
CVE-2026-59387 Broken access control restriction in Cloud Controller API
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/dropletcompleted and...
CVE-2026-115216
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...
CVE-2026-113644
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands edgelet provision and edgelet config cert on supported releases; iofog-agent provision and iofog-agent...
EUVD-2026-110762
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands edgelet provision and edgelet config cert on supported releases; iofog-agent provision and iofog-agent...
CVE-2026-113644
Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1 are vulnerable to command injection . The root cause is the unsanitized concatenation of the provisioning key and CA certificate from the Controller API into shell commands (such as edgelet provision or iofog-agent p...
CVE-2026-113644 iofogctl command injection via Controller provisioning response
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands edgelet provision and edgelet config cert on supported releases; iofog-agent provision and iofog-agent...
CVE-2026-113644
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands "edgelet provision" and "edgelet config cert" on supported releases; "iofog-agent provision" and...
CVE-2026-113644 iofogctl command injection via Controller provisioning response
In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands edgelet provision and edgelet config cert on supported releases; iofog-agent provision and iofog-agent...
EUVD-2026-110758
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...
CVE-2026-115216
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...
CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...
CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...
CVE-2026-115216
Eclipse ioFog Operator versions 3.8.0 before 3.9.2 are vulnerable to a security flaw where TLS certificate verification is disabled during communication with the Controller API and external OIDC issuers. This allows an on-path attacker to present any certificate to intercept sensitive credentials...
Eclipse ioFog Operator command injection vulnerability
Versions 1.0.0 through 3.7.0 and versions 3.8.0-rc.1 through 3.9.1 of the Eclipse ioFog Operator contain a command injection vulnerability. This vulnerability arises because the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands, allowing...
PT-2026-126388
In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator contacts the Controller API and when it logs in to an external OIDC issuer. An on-path attacker can present any certificate, capture the OAuth client secret external mode or the...