Advisories · Technology
wazuh-manager.
Every CVE that names wazuh-manager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file
- wazuh-manager
- Path traversal
- CVSS 6.9 Medium
Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition
- wazuh-manager
- Authentication bypass
- CVSS 7.1 High
Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
- wazuh-manager
- Information disclosure
- CVSS 7.1 High
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
- wazuh-manager
- Memory corruption
- CVSS 8.5 High
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
- wazuh-manager
- Path traversal
- CVSS 8.6 High
Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
- wazuh-manager
- CWE-178
- CVSS 9.4 CriticalCritical · CVSS 9+
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
- wazuh-manager
- Broken access control
- CVSS 8.6 High
Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
- wazuh-manager
- Authentication bypass
- CVSS 8.6 High
Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
- wazuh-manager
- Broken access control
- CVSS 8.7 High
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
- wazuh-manager
- Broken access control
- CVSS 8.4 High
Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
- wazuh-manager
- Path traversal
- CVSS 5.3 Medium
Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions
- wazuh-manager
- Broken access control
- CVSS 7.0 High
Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
- wazuh-manager
- Path traversal
- CVSS 6.9 Medium
Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
- wazuh-agent
- wazuh-manager
- Denial of service
- CVSS 6.9 Medium
Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb
- wazuh-manager
- CWE-409
- CVSS 7.0 High
Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
- wazuh-manager
- Path traversal
- CVSS 7.1 High
Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context
- wazuh-manager
- Denial of service
- CVSS 7.0 High
Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment
- wazuh-manager
- Path traversal
- CVSS 7.1 High
Wazuh Agent and Manager OS Command Injection and Untrusted Search Path
- wazuh-agent
- wazuh-manager
- Code injection
- CVSS 6.9 Medium
Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service
- wazuh-manager
- Broken access control
- CVSS 6.9 Medium
SSL/TLS Renegotiation DoS in Wazuh Manager authd service
- wazuh-manager
- Broken access control