Advisories · Technology
Quenary tugtainer.
Every CVE that names Quenary tugtainer among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification
- Quenary tugtainer
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint
- Quenary tugtainer
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset
- Quenary tugtainer
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
- Quenary tugtainer
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution
- Quenary tugtainer
- Code injection
- CVSS 8.1 High
Tugtainer vulnerable to Password Exposure via URL Query Parameter
- Quenary tugtainer
- CWE-598
- CVSS 8.1 High
Tugtainer has RCE in Agent Command Execution Api
- Quenary tugtainer
- Command injection