PT-2026-80650

Summary Repo under test: https://github.com/Netflix/lemur When ADMIN ONLY AUTHORITY CREATION=False an explicitly supported and documented configuration, POST /api/1/authorities with type=subca never verifies that the caller holds AuthorityPermission on the supplied parent authority. The parent...

CVE-2026-71317: Missing Authorization

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMINONLYAUTHORITYCREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority...

CommScope Ruckus ZoneFlex R500 Cross-Site Request Forgery Vulnerability

CommScope Ruckus ZoneFlex R500 is a wireless access point product from CommScope, Inc. A cross-site request forgery vulnerability exists in the login.asp page in the CommScope Ruckus ZoneFlex R500. An attacker could exploit this vulnerability to perform a crawl or other analysis with the SUBCA-1...

CVE-2020-8830

CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen...

CVE-2020-8830

CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen...

Cross site request forgery (csrf)

CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen...

CVE-2020-8830

CVE-2020-8830 affects Ruckus ZoneFlex/CommScope Ruckus hardware with CSRF in login.asp that can let an attacker access the panel and perform SSRF to crawl or analyze via the SUBCA-1 field on the Wireless Admin screen. The connected documents corroborate the CSRF flaw and SSRF usage vector but do ...

PT-2020-20313

Name of the Vulnerable Software and Affected Versions Ruckus devices affected versions not specified Description The issue allows an attacker to access the panel via CSRF in login.asp, and then potentially use SSRF to perform scraping or other analysis. This is achieved by exploiting the SUBCA-1...

CVE-2020-8830: Cross-Site Request Forgery (CSRF)

CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen...