62 matches found
CVE-2021-44103
CVE-2021-44103 KONGA 0.14.9에 대한 개념 증명 - 권한 상승. 소개 2021년 11월 16일, Fabrício Salomão와 저는 Konga API 게이트웨이에서 인증된 모든 사용자가 관리자가 될 수 있는 취약점을 발견했습니다. 취약점 보고 제품: KONGA 모델: 0.14.9 취약점: 권한 상승 영향: 전체 관리자 액세스 수직적 권한 상승 인증: 필요 익스플로잇 저자: Fabricio Salomao / Paulo Trindade PoC 아래에는 권한이 없는 "usernormal"이라는 일반 사용자가...
KONGA 0.14.9 - Privilege Escalation
KONGA 0.14.9 allows attackers to set higher privilege users to full administration access. The attack vector is a crafted condition, as demonstrated by the /api/user/ID at ADMIN parameter. id: CVE-2021-42192 info: name: KONGA 0.14.9 - Privilege Escalation author: rschio severity: high description...
CVE-2026-45221
Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing...
EUVD-2026-69428
Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing...
CVE-2026-45221 Konga < 2.1.0 Privilege Escalation via Hardcoded OpenSSL Path
Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing...
CVE-2026-45221
Konga before 2.1.0 is vulnerable to local privilege escalation via a hardcoded OpenSSL filesystem path that does not exist in default installations. On Windows , the missing directory sits in a location writable by any authenticated local user, allowing an attacker to create it and plant maliciou...
EUVD-2023-43546
Malicious code in bioql PyPI...
EUVD-2023-30777
Malicious code in bioql PyPI...
EUVD-2024-1536
Malicious code in bioql PyPI...
EUVD-2023-33908
Malicious code in bioql PyPI...
CVE-2023-39846
An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token...
CVE-2023-26987
An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via crafted POST request...
CVE-2023-2418
A vulnerability was found in Konga 2.8.3 on Kong. It has been classified as problematic. This affects an unknown part of the component Login API. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The...
CVE-2021-42192
Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation...
CVE-2024-34243
Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...
Konga is vulnerable to Cross Site Scripting (XSS) attacks
Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...
GHSA-93PF-MRC8-4G3H Konga is vulnerable to Cross Site Scripting (XSS) attacks
Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...
CVE-2024-34243
Konga v0.14.9 is vulnerable to Cross Site Scripting XSS via the username parameter...
