CVE-2023-36822

CVE-2023-36822 affects Uptime Kuma prior to 1.22.1. A path traversal vulnerability exists in the plugin installation flow: authenticated users can trigger removal checks on the plugin installation directory (via API endpoints still available after login) and, because plugins aren’t validated/sani...

CVE-2023-36822 Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss

Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...

CVE-2023-36821

CVE-2023-36821 affects Uptime Kuma prior to 1.22.1. An authenticated user can install a malicious plugin via the plugin installation flow, where plugins are installed with npm in the plugin directory. The plugin validation relies on an official plugin list and does not disable npm scripts during ...

CVE-2023-36821 Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is...

The vulnerability of the monitoring tool for VMware Aria Operations lies in the ability to execute commands, allowing a perpetrator to execute arbitrary code.

The vulnerability of the monitoring tool for VMware Aria Operations relates to the ability to execute commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the network and application monitoring tool VMware Aria Operations for Networks (previously vRealize Network Insight) is related to deficiencies in the deserialization mechanism, allowing attackers to execute arbitrary code.

The vulnerability of the network and application monitoring tool, VMware Aria Operations for Networks previously known as vRealize Network Insight, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to execute arbitrary code and increase their privileges.

The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code and increase their privileges...

The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to execute arbitrary code and increase their privileges.

The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute arbitrary code and increase their privileges...

The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to escalate their privileges.

The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges...

The vulnerability of the FortiAnalyzer event monitoring and analysis tool, related to insufficient password protection, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the FortiAnalyzer event monitoring and analysis tool is related to insufficient password protection. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information through a specially crafted request...

Debian: Security Advisory (DLA-713-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-25811

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma name parameter allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

Cross site scripting

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

Cross site scripting

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma name parameter allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-25811 Persistent Cross site scripting (XSS) in Uptime Kuma

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma name parameter allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-25811

CVE-2023-25811 describes a persistent cross-site scripting (XSS) vulnerability in Uptime Kuma before version 1.20.0, caused by the web UI field used for the application name. The untrusted value in the name parameter can be stored and later rendered, enabling a persistent XSS attack as noted in m...

CVE-2023-25810 Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

CVE-2023-25810

CVE-2023-25810 affects Uptime Kuma (self-hosted monitoring tool). The vulnerability is a persistent XSS on the status page in versions prior to 1.20.0. Upgrade to version 1.20.0 or later to fix; there are no documented workarounds. The available sources confirm the issue and the recommended remed...

CVE-2023-25810 Persistent Cross site scripting (XSS) through description in status page in Uptime Kuma

Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

PT-2023-20321 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.20.0 Description: Uptime Kuma is a self-hosted monitoring tool. The name parameter in Uptime Kuma allows a persistent XSS attack. Users are advised to upgrade as there are no known workarounds for this issue...