CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-39337 – Permission bypass due to incorrect configuration in github.com/dromara/hertzbeat
https://notcve.org/view.php?id=CVE-2022-39337
22 Dec 2023 — Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue. Hertzbeat es un sistema de monitoreo en tiempo real de código abierto con monitoreo personalizado, clúster de alto rendimiento, similar a Prometheus y sin agentes. • https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-44794
https://notcve.org/view.php?id=CVE-2023-44794
25 Oct 2023 — An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. Un problema en Dromara SaToken versión 1.36.0 y anteriores permite a un atacante remoto escalar privilegios a través de un payload manipulado a la URL. • https://github.com/dromara/Sa-Token/issues/515 • CWE-284: Improper Access Control •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-43961
https://notcve.org/view.php?id=CVE-2023-43961
25 Oct 2023 — An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass. Un problema en Dromara SaToken versión 1.3.50RC y anteriores al usar controladores dinámicos Spring, una solicitud especialmente manipulada puede provocar una omisión de autenticación. • https://github.com/dromara/Sa-Token/issues/511 • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-31581
https://notcve.org/view.php?id=CVE-2023-31581
24 Oct 2023 — Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. Se descubrió que Dromara Sureness anterior a v1.0.8 utilizaba una clave codificada. • https://github.com/dromara/sureness/issues/164 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3276 – Dromara HuTool XML Parsing Module XmlUtil.java readBySax xml external entity reference
https://notcve.org/view.php?id=CVE-2023-3276
15 Jun 2023 — A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. • https://fbdhhhh47.github.io/2023/06/06/hutool-XXE • CWE-611: Improper Restriction of XML External Entity Reference •