github.com/fleetdm/fleet/v4 vulnerabilities (Go)
32 vulnerabilities.
-
github.com/fleetdm/fleet/v4Go Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints 2.3 Low -
github.com/fleetdm/fleet/v4Go Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs 6.9 Medium -
github.com/fleetdm/fleet/v4Go Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database 7.6 High -
github.com/fleetdm/fleet/v4Go Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint 6.5 Medium -
github.com/fleetdm/fleet/v4Go Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint 4.3 Medium -
github.com/fleetdm/fleet/v4Go Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint 6.5 Medium -
github.com/fleetdm/fleet/v4Go Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint 6.5 Medium -
github.com/fleetdm/fleet/v4Go Fleet: IP spoofing allows bypassing API rate limiting 6.9 Medium -
github.com/fleetdm/fleet/v4Go Fleet vulnerable to OS command injection in software packages 6.0 Medium -
github.com/fleetdm/fleet/v4Go Fleet server may terminate unexpectedly when handling certain gRPC requests 8.7 High -
github.com/fleetdm/fleet/v4Go Fleet Windows MDM Azure AD JWT Authentication Bypass 8.2 High -
github.com/fleetdm/fleet/v4Go Fleet has a rate limiting bypass via untrusted client IP headers 6.9 Medium -
github.com/fleetdm/fleet/v4Go Fleet has a Windows MDM management endpoint authentication bypass 8.2 High -
github.com/fleetdm/fleet/v4Go Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit 7.8 High -
github.com/fleetdm/fleet/v4Go Fleet's user account creation via invite does not enforce invited email address 4.9 Medium -
github.com/fleetdm/fleet/v4Go Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint 6.6 Medium -
github.com/fleetdm/fleet/v4Go Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin 6.3 Medium -
github.com/fleetdm/fleet/v4Go Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database 6.2 Medium -
github.com/fleetdm/fleet/v4Go Fleet's team maintainer can transfer hosts from any team via missing source team authorization 4.9 Medium -
github.com/fleetdm/fleet/v4Go Fleet's unbounded request body read allows remote Denial of Service 8.7 High -
github.com/fleetdm/fleet/v4Go Fleet: Password reset tokens remain valid after password change for 24 hours 6.0 Medium -
github.com/fleetdm/fleet/v4Go Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users 1.3 Low -
github.com/fleetdm/fleet/v4Go Fleet: Authorization Bypass in certificate template batch deletion for team administrators 1.2 Low -
github.com/fleetdm/fleet/v4Go Fleet: Device lock PIN can be predicted if lock time is known 0.6 Low -
github.com/fleetdm/fleet/v4Go Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint 1.7 Low -
github.com/fleetdm/fleet/v4Go Fleet has a SQL injection via backtick escape in ORDER BY parameter 5.1 Medium -
github.com/fleetdm/fleet/v4Go Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment 9.3 Critical -
github.com/fleetdm/fleet/v4Go Fleet has an Access Control vulnerability in debug/pprof endpoints 6.3 Medium -
github.com/fleetdm/fleet/v4Go Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability 5.5 Medium -
github.com/fleetdm/fleet/v4Go SAML authentication vulnerability due to improper SAML response validation 9.3 Critical -
github.com/fleetdm/fleet/v4Go Limited ability to spoof SAML authentication with missing audience verification 5.3 Medium -
github.com/fleetdm/fleet/v4Go SAML authentication vulnerability in Fleet 10.0 Critical