GHSA-GVHC-WV3V-7PF8 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Summary Authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOverview only checks lenuser.Roles 0, so it returns...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GetOverview handler in pkg/system/handler.go. An attacker can retrieve aggregate inventory and capacity data for a cluster they are not allowed to access by sending GET /api/v1/overview with x-cluster-name...

PT-2026-56294

Name of the Vulnerable Software and Affected Versions Kite versions prior to v0.12.3 Description Authenticated users can bypass cluster-based Role-Based Access Control RBAC to retrieve aggregate inventory and capacity data from clusters they are not authorized to access. This occurs because the...

CVE-2021-47710

COMMAX Smart Home System is a smart IoT home solution that allows an unauthenticated attacker to disclose RTSP credentials in plain-text by exploiting the /overview.asp endpoint. Attackers can access sensitive information, including login credentials and DVR settings, by submitting a GET request ...

EUVD-2021-34729

COMMAX Smart Home System is a smart IoT home solution that allows an unauthenticated attacker to disclose RTSP credentials in plain-text by exploiting the /overview.asp endpoint. Attackers can access sensitive information, including login credentials and DVR settings, by submitting a GET request ...

CVE-2021-47710

COMMAX Smart Home System is a smart IoT home solution that allows an unauthenticated attacker to disclose RTSP credentials in plain-text by exploiting the /overview.asp endpoint. Attackers can access sensitive information, including login credentials and DVR settings, by submitting a GET request ...

CVE-2021-47710

CVE-2021-47710 affects COMMAX Smart Home System (Ruvie CCTV Bridge DVR Service). An unauthenticated attacker can disclose RTSP credentials in plain text via the /overview.asp endpoint by issuing a GET request, exposing login credentials and DVR settings. The vulnerability is described with high i...

CVE-2021-47710 COMMAX Smart Home Ruvie CCTV Bridge DVR Service RTSP Credentials Disclosure

COMMAX Smart Home System is a smart IoT home solution that allows an unauthenticated attacker to disclose RTSP credentials in plain-text by exploiting the /overview.asp endpoint. Attackers can access sensitive information, including login credentials and DVR settings, by submitting a GET request ...

COMMAX Smart Home System 访问控制错误漏洞

COMMAX Smart Home System is a smart home system from the Korean company COMMAX. An access control error vulnerability exists in the COMMAX Smart Home System that stems from a plaintext credential disclosure issue in the overview.asp endpoint, which could lead to the disclosure of sensitive...

PT-2025-50240

Name of the Vulnerable Software and Affected Versions COMMAX Smart Home System affected versions not specified Description An unauthenticated attacker can disclose RTSP credentials in plain text. This is achieved by exploiting the /overview.asp endpoint through a GET request. Successful...