CVE-2023-43805 Nexkey allows users to bypass authentication of Bull dashboard

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possibl...

CVE-2023-43805

Nexkey (Misskey fork) pre-12.121.9 is vulnerable due to incomplete URL validation, allowing bypass of authentication for access to the job queue dashboard. The issue is fixed in version 12.121.9. As a workaround, operators have used access-blocking measures (e.g., WAF rules like Cloudflare) to mi...

CVE-2023-43805 Nexkey allows users to bypass authentication of Bull dashboard

Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possibl...

CVE-2023-43793 Misskey allows users to bypass authentication of Bull dashboard

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

CVE-2023-43793 Misskey allows users to bypass authentication of Bull dashboard

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

CVE-2023-43793

Misskey before version 2023.9.0 is vulnerable: by editing the URL, an attacker can bypass authentication for the Bull dashboard (the job queue UI) and access it. The Red Hat, NVD, OSV, and other connected sources consistently describe this as an authentication bypass affecting Misskey prior to 20...

Nexkey Authorization Issues Vulnerability

Nexkey is an open source, decentralized social media platform for nexryai individual developers. An authorization issue vulnerability exists in Nexkey versions prior to 12.121.9 that stems from allowing an attacker to bypass authentication to access the job queue dashboard...

PT-2023-28985 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 2023.9.0 Description: Misskey is an open source, decentralized social media platform. A user can bypass the authentication of the Bull dashboard, which is the job queue management UI, by editing the URL. This allows...

Misskey Authorization Issues Vulnerabilities

Misskey is a suite of micro-blogging platforms. An authorization issue vulnerability exists in versions of Misskey prior to 2023.9.0 that stems from the ability to bypass authentication in the Bull dashboard...

WordPress OPcache Dashboard Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)

Software OPcache Dashboard Type Plugin Vulnerable versions = 0.3.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45064 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 88a7f0a12d7e Credits LEE SE HYOUNG...

Security Bulletin: Operations Dashboard is vulnerable to denial of service due to Netty

Summary Operations Dashboard is vulnerable to denial of service due to Netty CVE-2023-34462 with details below. Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS...

Security Bulletin: Operations Dashboard is vulnerable to header injection due to Golang Go

Summary Operations Dashboard is vulnerable to header injection due to Go CVE-2023-29406 with details below. Vulnerability Details CVEID:CVE-2023-29406 DESCRIPTION: Golang Go is vulnerable to HTTP header injection, caused by improper contents validation of Host header by the HTTP/1 client. By...

CVE-2023-44275

OPNsense before 23.7.5 allows XSS via the index.php columncount parameter to the Lobby Dashboard...

CVE-2023-44275

OPNsense before 23.7.5 allows XSS via the index.php columncount parameter to the Lobby Dashboard...

CVE-2023-44276

OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard...

Cross site scripting

OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard...

Cross site scripting

OPNsense before 23.7.5 allows XSS via the index.php columncount parameter to the Lobby Dashboard...

CVE-2023-44275

OPNsense before 23.7.5 allows XSS via the index.php columncount parameter to the Lobby Dashboard...

CVE-2023-44275

OPNsense before 23.7.5 allows XSS via the index.php columncount parameter to the Lobby Dashboard...

CVE-2023-44276

OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard...