Advisories · Technology
Finsys dockhand.
Every CVE that names Finsys dockhand among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook
- Finsys dockhand
- Information disclosure
- CVSS 8.7 High
Dockhand before 1.0.54 Path Traversal via Stack Environment Routes
- Finsys dockhand
- Path traversal
- CVSS 7.1 High
Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
- Finsys dockhand
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
Dockhand: Unauthenticated container exec via WebSocket upgrade
- Finsys dockhand
- Authentication bypass
- Broken access control
- CVSS 6.3 Medium
Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
- Finsys dockhand
- Other injection
- CVSS 8.4 High
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
- Finsys dockhand
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory
- Finsys dockhand
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
- Finsys dockhand
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
- Finsys dockhand
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints
- Finsys dockhand
- Authentication bypass
- CVSS 5.3 Medium
Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint
- Finsys dockhand
- Open redirect