27 matches found
CVE-2026-105936
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...
CVE-2026-105869
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...
EUVD-2026-107473
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...
CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...
EUVD-2026-107422
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...
CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...
CVE-2026-105869
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...
CVE-2026-105869
Apache Pulsar's MultiRolesTokenAuthorizationProvider contains a vulnerability where it fails to verify the signature of JSON Web Tokens (JWT) during authorization. When anonymousUserRole is set to a non-empty value and strictAuthMethod is false (default), requests with failed credentials may fall...
PT-2026-120756
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...
PT-2026-120723
Name of the Vulnerable Software and Affected Versions Apache Pulsar versions 2.8.1 through 4.0.13 Apache Pulsar versions 4.1.0 through 4.2.4 Description MultiRolesTokenAuthorizationProvider authorizes clients based on roles listed in a JSON Web Token JWT claim but fails to verify the token...
EUVD-2024-0897
Malicious code in bioql PyPI...
EUVD-2025-27501
Malicious code in bioql PyPI...
EUVD-2022-52453
Malicious code in bioql PyPI...
CVE-2024-24573
facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can...
CVE-2024-24767
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. Th...
Password Brute Force Attack
github.com/icewhaletech/casaos-userservice is vulnerable to Password Brute Force Attack. The vulnerability is due to a lack of control on login attempts missing a rate limit on login. This enables attackers to gain super user-level access to the server, allowing unauthorized access to the server...
PT-2024-20545 · Casaos · Casaos
Name of the Vulnerable Software and Affected Versions: CasaOS versions 0.4.4.3 through 0.4.6 Description: The CasaOS web application lacks control over login attempts, allowing attackers to perform password brute force attacks and gain full access to the server with super user-level access...
CVE-2022-30622
Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sysusernamepasswd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within...
Default credentials
Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sysusernamepasswd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within...
CVE-2022-30622 Chcnav - P5E GNSS Information disclosure
Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sysusernamepasswd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within...