65 matches found
CVE-2023-36650
CVE-2023-36650 concerns ProLion CryptoSpike 3.0.15P2, where a missing integrity check in the software’s update system allows an attacker to run OS commands as root on the host via forged updates. The vulnerability affects the update mechanism (update system) and the root-level impact is described...
ProLion CryptoSpike Security Vulnerability
ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2 that originates from the insertion of sensitive information in a centralized Grafana logging system...
CVE-2023-36647
Summary: CVE-2023-36647 affects ProLion CryptoSpike 3.0.15P2, where a hard-coded cryptographic private key is used to sign JWTs, enabling remote impersonation of users/roles in web management and REST API endpoints. The vulnerability arises from the use of a private key embedded in the product, e...
CVE-2023-36654
Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download host server SSH private keys associated with a Linux root user by injecting paths inside REST API endpoint parameters...
ProLion CryptoSpike Security Vulnerability
ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2 that stems from SQL injection when a user searches a REST API endpoint...
CVE-2023-36651
Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials...
ProLion CryptoSpike Security Vulnerability
ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2 that stems from a lack of integrity checks in the update system...
ProLion CryptoSpike Security Vulnerability
ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2 that stems from the use of hard-coded encrypted private keys that sign JWT authentication tokens...
ProLion CryptoSpike Security Vulnerability
ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2 that stems from directory traversal in the Log Download REST API endpoint...
CVE-2023-36652
CVE-2023-36652 describes a SQL injection in ProLion CryptoSpike 3.0.15P2's users searching REST API endpoint. The underlying issue is unsafely constructed SQL in the search parameter, allowing remote authenticated attackers to read database data. Affected product: ProLion CryptoSpike (version 3.0...
CVE-2023-36649
ProLion CryptoSpike 3.0.15P2 is affected by an authentication/authorization issue arising from insertion of sensitive information into the centralized Grafana logging system, enabling remote attackers to impersonate other users in web management and REST API by reading JWT tokens from logs or the...
PT-2023-25651 · Apache +1 · Apache Kafka +1
Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: The issue is related to missing authentication in the internal data streaming system, allowing remote unauthenticated users to read potentially sensitive information and deny service to users...
PT-2023-25657 · Prolion · Prolion Cryptospike
Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: The issue allows remote authenticated attackers to download host server SSH private keys associated with a Linux root user by injecting paths inside REST API endpoint parameters, specifically ...
PT-2023-25650 · Prolion · Prolion Cryptospike
Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: A hard-coded cryptographic private key used to sign JWT authentication tokens allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via...
CVE-2023-36646
CVE-2023-36646 affects ProLion CryptoSpike 3.0.15P2. The issue is incorrect user role checking in multiple REST API endpoints, enabling a remote attacker with low privileges to call privileged functions and achieve privilege escalation via REST endpoint invocation. The NVD entry rates the impact ...
PT-2023-25656 · Prolion · Prolion Cryptospike
Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: A SQL Injection issue exists in the users searching REST API endpoint, allowing remote authenticated attackers to read database data via SQL commands injected in the search parameter...
PT-2023-25654 · Prolion · Prolion Cryptospike
Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: A missing integrity check in the update system allows attackers to execute OS commands as the root Linux user on the host system via forged update packages. Recommendations: For ProLion...
PT-2023-25655 · Prolion · Prolion Cryptospike
Name of the Vulnerable Software and Affected Versions: ProLion CryptoSpike version 3.0.15P2 Description: The issue concerns hidden and hard-coded credentials in the software, allowing remote attackers to login to web management as a super-admin. This access enables the consumption of the most...
CVE-2023-36655
The login REST API in ProLion CryptoSpike 3.0.15P2 when LDAP or Active Directory is used as the users store allows a remote blocked user to login and obtain an authentication token by specifying a username with different uppercase/lowercase character combination...
CVE-2023-36655
The login REST API in ProLion CryptoSpike 3.0.15P2 when LDAP or Active Directory is used as the users store allows a remote blocked user to login and obtain an authentication token by specifying a username with different uppercase/lowercase character combination...