402 matches found
Uptime Kuma License Issue Vulnerability
Uptime Kuma is an easy-to-use, self-hosted monitoring tool from the individual developer Louis Lam. An authorization issue vulnerability exists in Uptime Kuma versions prior to 1.23.3, which stems from a lack of session token validation after a password change or after a period of inactivity, and...
PT-2023-29233 · Unknown · Uptime Kuma
Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.3 Description: The issue allows attackers with access to a user's device to gain persistent account access due to missing verification of Session Tokens after password changes and/or elapsed inactivity...
CVE-2023-4997
Improper authorisation of regular users in ProIntegra Uptime DC software versions below 2.0.0.33940 allows them to change passwords of all other users including administrators leading to a privilege escalation...
CVE-2023-4997
Improper authorisation of regular users in ProIntegra Uptime DC software versions below 2.0.0.33940 allows them to change passwords of all other users including administrators leading to a privilege escalation...
Privilege escalation
Improper authorisation of regular users in ProIntegra Uptime DC software versions below 2.0.0.33940 allows them to change passwords of all other users including administrators leading to a privilege escalation...
CVE-2023-4997 Improper authorisation in Uptime DC
Improper authorisation of regular users in ProIntegra Uptime DC software versions below 2.0.0.33940 allows them to change passwords of all other users including administrators leading to a privilege escalation...
CVE-2023-4997 Improper authorisation in Uptime DC
Improper authorisation of regular users in ProIntegra Uptime DC software versions below 2.0.0.33940 allows them to change passwords of all other users including administrators leading to a privilege escalation...
CVE-2023-4997
CVE-2023-4997 affects ProIntegra Uptime DC software prior to version 2.0.0.33940. The issue is improper authorization that allows regular users to change passwords of all accounts, including administrators, enabling privilege escalation. The CVE is documented with CVSS v3.1 signals: AV:N/AC:L/PR:...
ProIntegra Uptime DC Security Vulnerability
ProIntegra Uptime DC is a dashboard from ProIntegra. A security vulnerability exists in versions prior to ProIntegra Uptime DC 2.0.0.33940, which stems from a misconfiguration of permissions, resulting in elevated privileges being available to normal users...
[SECURITY] Fedora 38 Update: procps-ng-3.3.17-11.fc38
The procps package contains a set of system utilities that provide system information. Procps includes ps, free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, pidof, pmap, slabtop, w, watch, pwdx and pidwait. The ps command displays a snapshot of running processes. The top command...
No check for active Arbitrum Sequencer
Lines of code Vulnerability details Impact If the Arbitrum sequencer goes down, the stale ratio will be used during the swap. Proof of Concept readChainlinkFeed gets the price from chainlink oracle and the ratio is used during the swap. function readChainlinkFeed uint256 quoteAmount,...
CVE-2023-36822
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...
CVE-2023-36821
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is...
Remote code execution
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is...
Path traversal
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...
CVE-2023-36822 Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...
CVE-2023-36822 Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...
CVE-2023-36822
CVE-2023-36822 affects Uptime Kuma prior to 1.22.1. A path traversal vulnerability exists in the plugin installation flow: authenticated users can trigger removal checks on the plugin installation directory (via API endpoints still available after login) and, because plugins aren’t validated/sani...
CVE-2023-36822 Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data loss
Uptime Kuma, a self-hosted monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are...
CVE-2023-36821
CVE-2023-36821 affects Uptime Kuma prior to 1.22.1. An authenticated user can install a malicious plugin via the plugin installation flow, where plugins are installed with npm in the plugin directory. The plugin validation relies on an official plugin list and does not disable npm scripts during ...