Vendors / Tyk Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 0
Exploited now Tyk records in CISA KEV No Tyk vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01247 · Published 2023-11-07 · No fix listed CWE-89
Priority HIGH 82
Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01247 · Published 2023-11-07 · No fix listed CWE-89
Priority MEDIUM 41
The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass.
CVSS 3.1 CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01011 · Published 2021-04-26 · Fixed in 1.1.1 CWE-287
Priority LOW 25
All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function.
CVSS 3.1 MEDIUM 5.3· Local · Low privileges · No interaction · EPSS 0.00525 · Published 2021-03-15 · No fix listed CWE-22
Open these records in search → All records by CVSS severity
3 0 1 0 0
THREATIST.IORead the docs