pterodactyl/panel vulnerabilities (Packagist)
19 vulnerabilities.
-
pterodactyl/panelPackagist Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions 8.1 High -
pterodactyl/panelPackagist Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) 7.5 High -
pterodactyl/panelPackagist Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system 5.5 Medium -
pterodactyl/panelPackagist Pterodactyl has a database resource limit bypass via race condition in Client API 2.3 Low -
pterodactyl/panelPackagist Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization 9.2 Critical -
pterodactyl/panelPackagist Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change 7.5 High -
pterodactyl/panelPackagist Pterodactyl's improper resource locking allows raced queries to create more resources than alloted 6.0 Medium -
pterodactyl/panelPackagist Pterodactyl TOTPs can be reused during validity window 6.5 Medium -
pterodactyl/panelPackagist Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced 7.5 High -
pterodactyl/panelPackagist Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host” 2.0 Low -
pterodactyl/panelPackagist Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution 10.0 Critical -
pterodactyl/panelPackagist Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled 4.6 Medium -
pterodactyl/panelPackagist Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel 6.1 Medium -
pterodactyl/panelPackagist Insufficient Session Expiration in Pterodactyl API 6.0 Medium -
pterodactyl/panelPackagist Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys 4.3 Medium -
pterodactyl/panelPackagist logout CSRF in Pterodactyl Panel 4.3 Medium -
pterodactyl/panelPackagist Authentication bypass in Pterodactyl 8.1 High -
pterodactyl/panelPackagist XSS vulnerability when listing users on add & modify server pages. No score -
pterodactyl/panelPackagist Pterodactyl vulnerable to 2FA Sniffing 7.5 High