70 matches found
microctfs
microctfs Small CTF challenges running on Docker logviewer Build and Start logviewer challenge exposed on port 8000 cd logviewer docker build -t logviewer . docker run -d -p 8000:80 --name logchallenge logviewer Restart logviewer challenge docker rm -f logchallenge && docker run -d -p 8000:80...
microctfs
microctfs Petits défis CTF fonctionnant sous Docker logviewer Construire et démarrer le défi logviewer exposé sur le port 8000 cd logviewer docker build -t logviewer . docker run -d -p 8000:80 --name logchallenge logviewer Redémarrer le défi logviewer docker rm -f logchallenge && docker run -d -p...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to improper enforcement of access controls in the Logviewer process. An attacker can gain unauthorized access to sensitive daemon log files and metadata by sending requests to the affected endpoints after passi...
CVE-2026-82438
Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...
CVE-2026-82437
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
EUVD-2026-77516
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
CVE-2026-82437
The Apache Storm Logviewer suffers from a flaw where log access controls are not enforced for daemon logs. Specifically, the system incorrectly discards authorizer results when a "this is a daemon log" flag is set, and certain endpoints reach handlers without consulting an authorizer. This allows...
CVE-2026-82437 Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
CVE-2026-82437 Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
CVE-2026-82437: Missing Authorization
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
CVE-2026-82438: Origin Validation Error
Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...
PT-2026-91232
Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...
PT-2026-91233
Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...
EUVD-2021-0761
Malware in sbrugna...
EUVD-2013-6620
Malware in sbrugna...
EUVD-2022-5140
Malicious code in bioql PyPI...
CVE-2020-29454
Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access...
CVE-2019-0202
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...
SUSE CVE-2019-0202
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...
Exposure of Sensitive Information in Apache Storm Logviewer
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...