108 matches found
thingsboard
开源物联网平台，用于数据收集、处理、可视化及设备管理。 💡 开始使用 • 🌐 网站 • 📚 文档 • 📔 博客 • 🔗 LinkedIn 🚀 安装选项 在本地安装ThingsBoard，或使用ThingsBoard Cloud。 💡 开始使用ThingsBoard 请查看我们的入门指南或观看视频，了解ThingsBoard的基础知识并创建你的第一个仪表板！你将学习： 将设备连接到ThingsBoard 从设备推送数据到ThingsBoard 构建实时仪表板 创建客户并为其分配仪表板 定义阈值并触发告警 通过电子邮件、短信、移动应用设置通知，或集成第三方服务 ✨ 特性 配置和管理 设备及资...
CVE-2026-71278
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...
CVE-2026-71278
The rust-iot-platform contains an unauthenticated endpoint to create a calc rule (POST /calc-rule/create) where a user-supplied script field is stored and later evaluated with quick_js::Context::eval() without sandboxing. Because this route bypasses the AuthToken guard, an unauthenticated attacke...
CVE-2026-71278 rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...
CVE-2026-71278
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...
CVE-2026-71278 rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...
CVE-2026-71277
Affected software: rust-iot-platform, specifically the AuthToken request-guard in api/src/main.rs. Vulnerability: the guard only checks for the presence of the Authorization header, with no validation against sessions, token stores, or signatures. Any non-empty header (e.g., Authorization: fake) ...
CVE-2026-71277
rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...
CVE-2026-50244 Naxclow IoT Platform Missing Authorization
The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequential device identifier and returns the current high-water...
FastBee 跨站脚本漏洞
FastBee is an open-source IoT platform developed by FastBee in China. Versions of FastBee 1.2.1 and earlier contained a cross-site scripting vulnerability. This vulnerability originated from the function Add in the parameter handling of noticeContent within the System Notice Handler component,...
OpenRemote 安全漏洞
OpenRemote is an open-source IoT platform developed by OpenRemote. Versions of OpenRemote prior to 1.22.0 contained security vulnerabilities. These vulnerabilities were caused by two related expression injections in the rule engine, which could allow arbitrary code to execute on the server...
Nokia IMPACT 安全漏洞
Nokia IMPACT is a set of IoT intelligent management platforms developed by Finnish company Nokia. Versions of Nokia IMPACT such as 19.11.2.10-20210118042150283 and earlier contain security vulnerabilities. These vulnerabilities stem from the Applications component, which allows JavaScript files t...
CVE-2022-31861
Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...
CVE-2022-35134
Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting XSS vulnerability...
CVE-2021-41278
Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allo...
EUVD-2017-16882
Malware in sbrugna...
EUVD-2021-2305
Malware in sbrugna...
EUVD-2020-19243
Malware in sbrugna...