Advisories · Technology
nerves-hub nerves_hub_web.
Every CVE that names nerves-hub nerves_hub_web among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.4 CriticalCritical · CVSS 9+
Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
- nerves-hub nerves_hub_web
- Authentication bypass
- CVSS 5.3 Medium
Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups
- nerves-hub nerves_hub_web
- Broken access control
- CVSS 2.3 Low
Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
- nerves-hub nerves_hub_web
- CWE-1464
- CWE-1465
- CVSS 8.6 High
Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
- nerves-hub nerves_hub_web
- Broken access control
- CVSS 7.4 High
Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else
- nerves-hub nerves_hub_web
- Authentication bypass
- CWE-345
- CVSS 7.1 High
Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
- nerves-hub nerves_hub_web
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Improper authorization in device bulk actions and device update API allows cross-organization device control
- nerves-hub nerves_hub_web
- Broken access control
- Information disclosure
- CVSS 9.5 CriticalCritical · CVSS 9+
NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force
- nerves-hub nerves_hub_web
- Weak cryptography or TLS