Advisories · Technology
LizardByte Sunshine.
Every CVE that names LizardByte Sunshine among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.6 High
Disabled Sunshine clients can bypass revocation with a derived client certificate
- LizardByte Sunshine
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Sunshine: Authentication bypass via improper client certificate validation
- LizardByte Sunshine
- Authentication bypass
- Weak cryptography or TLS
- CVSS 6.7 Medium
SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution
- LizardByte Sunshine
- CWE-428
- CVSS 9.7 CriticalCritical · CVSS 9+
Sunshine application-wide CSRF in the UI leads to command injection as Administrator
- LizardByte Sunshine
- Cross-site request forgery (CSRF)
- CVSS 5.4 Medium
Sunshine clickjacking in the UI leads to unauthorized actions being performed
- LizardByte Sunshine
- CWE-1021
- CVSS 7.7 High
Sunshine improperly enforces pairing protocol request order
- LizardByte Sunshine
- Memory corruption
- CWE-305
- CVSS 6.5 Medium
Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client
- LizardByte Sunshine
- CWE-300
- CVSS 4.9 Medium
Sunshine's unquoted executable path could lead to hijacked execution flow
- LizardByte Sunshine
- CWE-428
- CVSS 5.9 Medium
Clients removed during unpairing process may regain access if Sunshine was not restarted
- LizardByte Sunshine
- Authentication bypass
- CVSS 7.3 High
Sunshine vulnerable to remote unauthenticated arbitrary file read
- LizardByte Sunshine
- Path traversal