|
About the Security Adivsories category
|
|
0
|
28
|
March 3, 2025
|
|
ZAC Node Server /sso Endpoint Allowing Unauthenticated Admin Session-Token Theft
|
|
2
|
39
|
September 30, 2026
|
|
Stored XSS in the network visualizer via unescaped entity names
|
|
0
|
22
|
September 29, 2026
|
|
Ziti Admin Console (ZAC) Node server: unauthenticated /api/send endpoint allows file read and mail relay
|
|
0
|
29
|
September 29, 2026
|
|
Ziti Admin Console (ZAC) Node server: unauthenticated /api/schema endpoint allows arbitrary file read and SSRF
|
|
0
|
36
|
September 29, 2026
|
|
OpenZiti edge router MFA posture nil-pointer panic causing authenticated router DoS
|
|
0
|
30
|
August 26, 2026
|
|
Unauthenticated Memory Exhaustion via Unbounded Pre-Auth Request Body Buffering
|
|
0
|
26
|
August 26, 2026
|
|
Legacy Enrollment Path Doubles Per-Request Memory Allocation, Amplifying Memory Exhaustion DoS
|
|
0
|
26
|
August 26, 2026
|
|
Zrok copy writes attacker-controlled WebDAV paths outside the destination root
|
|
0
|
45
|
May 13, 2026
|
|
Zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
|
|
0
|
27
|
May 13, 2026
|
|
Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
|
|
0
|
39
|
April 16, 2026
|
|
Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
|
|
0
|
53
|
April 16, 2026
|
|
Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering
|
|
0
|
44
|
April 16, 2026
|
|
Server Side Request Forgery Vulnerability in Ziti Console
|
|
0
|
58
|
March 3, 2025
|
|
Cross Site Scripting Vulnerability in Ziti Console
|
|
0
|
59
|
March 3, 2025
|