THREATIST.IORead the docs 30 records
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service.
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction.
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses.
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header.
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded.
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path.
Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem.
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint.
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users.
Nezha is a server and website monitoring tool.
Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist did not cover IPv6 transition ranges — specifically the 6to4 prefix 2002…
Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service…
Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool.