Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
nats nats server vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2023-46129
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is us...
Nats Nkeys
Nats Nats Server
NA
CVE-2023-47090
NATS nats-server prior to 2.9.23 and 2.10.x prior to 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earlies...
Linuxfoundation Nats-server
NA
CVE-2022-28357
NATS nats-server 2.2.0 up to and including 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.
Linuxfoundation Nats-server
357
VMScore
CVE-2022-26652
NATS nats-server prior to 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server prior to 0.24.3 is also affected.
Nats Nats Server
Nats Nats Streaming Server
3 Github repositories
802
VMScore
CVE-2022-24450
NATS nats-server prior to 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
Nats Nats Streaming Server
Nats Nats Server
3 Github repositories
445
VMScore
CVE-2021-3127
NATS Server 2.x prior to 2.2.0 and JWT library prior to 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
Nats Jwt Library
Nats Nats Server
445
VMScore
CVE-2020-28466
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users pre...
Nats Nats Server
668
VMScore
CVE-2020-26892
The JWT library in NATS nats-server prior to 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
Linuxfoundation Nats-server
Fedoraproject Fedora 33
445
VMScore
CVE-2020-26521
The JWT library in NATS nats-server prior to 2.1.9 allows a denial of service (a nil dereference in Go code).
Linuxfoundation Nats-server
Fedoraproject Fedora 33
445
VMScore
CVE-2020-26149
NATS nats.js prior to 2.0.0-209, nats.ws prior to 1.0.0-111, and nats.deno prior to 1.0.0-9 allow credential disclosure from a client to a server.
Linuxfoundation Nats.deno
Linuxfoundation Nats.js
Linuxfoundation Nats.ws
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32976
CVE-2024-33557
CVE-2024-36801
CVE-2024-35654
authentication bypass
CVE-2024-24919
CSRF
code execution
CVE-2024-27348
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »