Authentication Bypass

github.com/gravitl/netmaker is vulnerable to Authentication Bypass. The vulnerability is due to the VerifyHostToken function failing to validate JWT signatures when verifying host tokens, which allows an attacker to forge a JWT signed with an arbitrary key and impersonate any host in the network ...

Information Disclosure

Free5GC is vulnerable to Information Disclosure. The vulnerability is due to improper request handling in the UDR endpoint GET /nudr-dr/v2/application-data/influenceData/subs-to-notify, where error responses for missing or malformed parameters do not terminate execution. As a result, processing...

Server-Side Request Forgery

github.com/quantumnous/new-api, is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to incomplete SSRF protection that fails to block the unspecified address 0.0.0.0, allowing authenticated users to bypass private-IP filtering and force the server to make requests to...

Authentication Bypass

Soft Serve is vulnerable to Authentication Bypass. The vulnerability is due to improper session context handling during the SSH authentication process, which allows an attacker to impersonate any user by offering the victim's public key before authenticating with their own valid key...

Server-Side Request Forgery

esm.sh is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation in the /https fetch route, where localhost and internal network protections rely on hostname string checks that can be bypassed using DNS alias domains, allowing attackers to induce...

Remote Code Execution (RCE)

Yoke is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient validation of the overrides.yoke.cd/flight annotation in the Air Traffic Controller ATC component, where attacker-controlled URLs are used to download and execute arbitrary WASM modules. This allows users wi...

Implicit Bearer Token Injection

github.com/kyverno/kyverno is vulnerable to Implicit Bearer Token Injection. The vulnerability is due to the apiCall service helper automatically injecting the Kyverno controller's Authorization: Bearer service account token into outbound requests when no authorization header is explicitly...

Exposure Of Sensitive Information

io.github.davidalmeidac, sealed-env-core is vulnerable to Exposure of Sensitive Information. The vulnerability is due to embedding the operator’s plaintext TOTP secret in the base64-encoded JWS payload of minted unseal tokens, which allows an attacker to decode observed tokens from logs,...

Improper Authorization

Fleet is vulnerable to Improper Authorization. The vulnerability is due to incomplete application of ServiceAccount impersonation in certain Helm deployer code paths, which allows an attacker with git push access to read secrets from arbitrary namespaces on downstream clusters...

Missing Authorization

github.com/portainer/portainer is vulnerable to Missing Authorization. The vulnerability is due to missing authorization handlers for the Docker plugin management endpoints, which allows a non-admin user with endpoint-level access to perform privileged plugin operations directly against the...

Improper Access Control

github.com/free5gc/udr is vulnerable to Improper Access Control. The vulnerability is due to improper request handling in the Traffic Influence Subscription deletion endpoint, which allows an attacker to bypass validation and delete arbitrary subscriptions despite receiving a misleading 404...

Missing Authentication For Critical Function

Sliver is vulnerable to Missing Authentication For Critical Function. The vulnerability is due to the DNS C2 listener allocating server-side sessions without validating TOTP values and lacking session cleanup, which allows an attacker to create excessive sessions and exhaust server memory...

SQL Injection

Focalboard is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of category IDs before they are incorporated into dynamic SQL statements, which allows an attacker to inject malicious SQL that is later executed and used to extract sensitive data from the database...

Command Injection

uniget is vulnerable to Command Injection. The vulnerability is due to unsafe execution of the untrusted check field from metadata files through /bin/bash -c without proper validation or sanitization, which allows an attacker to execute arbitrary shell commands on the victim's system...

SQL Injection

github.com/jackc/pgx is vulnerable to SQL Injection. The vulnerability is due to improper handling of dollar-quoted string literals when using the non-default simple protocol, which allows an attacker to inject malicious SQL queries by controlling placeholder values interpreted outside the string...

Origin Validation Error

Dozzle is vulnerable to Origin Validation Error. The vulnerability is due to improper origin validation in the WebSocket upgrader, where connections from any origin are accepted and authenticated with the victim's JWT cookie, allowing attackers to hijack authenticated sessions and gain unauthoriz...

Sensitive Information Exposure

com.ritense.valtimo, web is vulnerable to sensitive information exposure. The vulnerability is due to the LoggingRestClientCustomizer automatically logging full HTTP request and response details, including headers and bodies, in error messages, which allows an attacker to access sensitive...

OS Command Injection

File Browser is vulnerable to OS command injection. The vulnerability is due to unsanitized variable substitution in the hook system, where attacker-controlled filenames containing shell metacharacters are expanded into administrator-defined shell commands, allowing attackers to execute arbitrary...

Denial Of Service (DoS)

volcano.sh/volcano is vulnerable to Denial of Service DoS. The vulnerability is due to the webhook server not enforcing a size limit on incoming HTTP request bodies, which allows an attacker with access to the in-cluster webhook endpoint to send arbitrarily large requests and cause the webhook...

Authorization Bypass

Netmaker is vulnerable to Authorization Bypass. The vulnerability is due to improper authorization logic in the Authorize middleware, where a valid host JWT token is accepted when hostAllowed=true without verifying that the host is authorized to access the specific target resource, allowing acces...

Sensitive Information Exposure

Harvester is vulnerable to Sensitive Information Exposure. The vulnerability is due to the interactive installer exposing the operating system’s default SSH login password during cluster creation or host addition, potentially allowing unauthorized access to affected systems...

Improper Access Control

Rancher is vulnerable to Improper Access Control. The vulnerability is due to missing authorization checks when handling cloud-credential IDs, which allows an attacker to make unauthorized requests to cloud providers using attached credentials...

Path Traversal

lakeFS is vulnerable to Path Traversal. The vulnerability is due to insufficient path validation in verifyRelPath within pkg/block/local/adapter.go, where strings.HasPrefix is used to validate storage paths without enforcing path boundaries. This allows authenticated users to use path traversal...

Cross-site Scripting (XSS)

FileBrowser Quantum is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of user-controlled share metadata fields when rendered in HTML using text/template, which allows an attacker to inject and execute malicious scripts when users visit a shared URL...

Improper Access Control

kcp is vulnerable to Improper Access Control. The vulnerability is due to the cache server being exposed without authentication or authorization controls, which allows an attacker to read from and write to the cache server if they can access the root shard...

Use Of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Cloudreve is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG. The vulnerability is due to the generation of security-sensitive secrets using math/rand seeded with predictable timestamps, which allows an attacker to recover the secret key, forge JWTs, and gain...

Command Injection

Arcane is vulnerable to Command Injection. The vulnerability is due to lifecycle label values such as com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update being passed directly to /bin/sh -c without sanitization, allowing authenticated users to inject...

Privilege Escalation

CloudNativePG is vulnerable to Privilege Escalation. The vulnerability is due to the metrics exporter establishing PostgreSQL sessions as the postgres superuser and relying on SET ROLE for privilege reduction, which allows an attacker to restore superuser privileges using RESET ROLE and execute...

Server-Side Request Forgery (SSRF)

github.com/centrifugal/centrifug is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of dynamic JWKS endpoint template variables, which allows an unauthenticated attacker to craft a malicious JWT with manipulated iss or aud claims to force Centrifugo t...

Authorization Bypass

Moby is vulnerable to Authorization Bypass. The vulnerability is due to a flaw in the authorization plugin AuthZ enforcement mechanism, allowing attackers to bypass configured authorization controls and perform actions that should have been restricted by authorization policies...

Denial Of Service (DoS)

GoBGP is vulnerable to Denial of Service DoS. The vulnerability is due to improper validation of malformed BGP UPDATE messages during processing of 4-byte AS attributes, where an internal slice index shift can trigger an index out of range panic, causing the GoBGP process to crash...

Server-Side Request Forgery

Arcane is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the /api/templates/fetch endpoint accepting a user-controlled url parameter and performing server-side HTTP requests without authentication or validation of the URL scheme and destination host, allowing...

OS Command Injection

Fleet is vulnerable to Command Injection. The vulnerability is due to improper sanitization of software package metadata used in auto-generated uninstall scripts, allowing specially crafted package metadata to inject and execute arbitrary commands with elevated privileges root on macOS/Linux or...

Path Traversal

github.com/ctfer-io/monitoring is vulnerable to a Path Traversal. The vulnerability is due to a missing trailing path separator in the strings.HasPrefix check within the sanitizeArchivePath function, which allows an attacker to perform arbitrary file writes via a crafted archive, potentially...

Denial Of Service (DoS)

Mattermost is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of excessively long passwords during authentication, which allows an attacker to consume excessive CPU and memory resources by submitting login attempts with multi-megabyte passwords...

Missing Authorization

github.com/argoproj/argo-workflows is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks in the Sync Service's ConfigMap-backed provider, which allows an attacker to create, read, update, and delete synchronization-related Kubernetes ConfigMaps without...

Authentication Bypass

MinIO is vulnerable to Authentication Bypass. The vulnerability is due to missing signature verification for authTypeStreamingUnsignedTrailer requests in the Snowball auto-extract handler, which allows an attacker with knowledge of a valid access key to upload arbitrary objects without providing ...

Improper Access Control

Traefik is vulnerable to Improper Access Control. The vulnerability is due to insufficient validation of TraefikService backend references ending with @internal, which allows an attacker with HTTPRoute creation permissions to access the internal REST provider and perform unauthorized configuratio...

Out-of-bounds Read

github.com/gomarkdown/markdown is vulnerable to an Out-of-Bounds Read. The vulnerability is due to improper handling of malformed Markdown input containing a character when processed by the SmartypantsRenderer, which allows an attacker to trigger an out-of-bounds read or cause the application to...

Improper Authorization

Kyverno is vulnerable to Improper Authorization. The vulnerability is due to missing validation of the configMap.namespace field in the ConfigMap context loader, which allows a namespace administrator to bypass RBAC restrictions and read ConfigMaps from arbitrary namespaces using Kyverno's...

Insufficient Verification Of Data Authenticity

go-git is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to improper handling of malformed or ambiguous Git object headers and reconstructing commit data for signing and verification instead of using the original raw object bytes, which allows an attacker t...

Server-Side Request Forgery (SSRF)

github.com/kyverno/kyvern is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the apiCall feature in ClusterPolicy automatically attaching the admission controller's ServiceAccount token to outbound HTTP requests without validating the destination URL, which allows an...

Improper Input Validation

github.com/filebrowser/filebrowser/v2 is vulnerable to an improper input validation. The vulnerability is due to the Upload-Length header being parsed as a signed 64-bit integer without validating that the value is non-negative, which allows an authenticated attacker with upload permissions to...

Improper Certificate Validation

Nebula is vulnerable to Improper Certificate Validation. The vulnerability is due to ECDSA signature malleability in P256 certificates, which allows an attacker to generate a certificate with a different fingerprint and bypass certificate fingerprint-based blocklist entries...

Server-Side Request Forgery (SSRF)

github.com/apache/skywalking-mcp is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the SW-URL header, which allows an attacker to supply arbitrary URLs and force the server to send requests to unintended internal or external resources...

Improper Input Validation

ingress-nginx is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of the nginx.ingress.kubernetes.io/auth-method Ingress annotation, which allows an attacker to inject malicious NGINX configuration, achieve arbitrary code execution in the ingress-nginx...

Exposure Of Sensitive Information

Portainer Community Edition is vulnerable to Exposure of Sensitive Information. The vulnerability is due to the authentication middleware accepting JWT bearer tokens through the ?token= URL query parameter, which allows an attacker to obtain authentication tokens from browser history, proxy logs,...

Arbitrary File Read

go-getter is vulnerable to Arbitrary File Read. The vulnerability is due to improper validation of maliciously crafted Git URLs during certain Git operations, where specially crafted URLs can access unintended file system paths, allowing attackers to read arbitrary files on the host system...

Denial Of Service

github.com/hashicorp/boundary is vulnerable to denial of service. The vulnerability is due to improper handling of TLS handshakes during worker node enrollment, where an attacker can delay or withhold the client certificate to block connection handling, allowing legitimate worker connections to b...

OS Command Injection

PicoClaw is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation and sanitization of input in the /api/gateway/restart endpoint of the Web Launcher Management Plane, which allows a remote attacker to inject and execute arbitrary system commands on the underlying...