Katriel Moses

Insecure PRNG and Information Exposure in urwid Web Display Backend

tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title

SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint

Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints

Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO

Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL