Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
envoy vulnerabilities and exploits
(subscribe to this query)
8.3
CVSSv3
CVE-2021-32777
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HT...
Envoyproxy Envoy 1.19.0
Envoyproxy Envoy
7.5
CVSSv3
CVE-2021-32780
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is tr...
Envoyproxy Envoy 1.19.0
Envoyproxy Envoy
5.5
CVSSv3
CVE-2018-17499
Envoy Passport for Android and Envoy Passport for iPhone could allow a local malicious user to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive informa...
Envoy Passport 2.4.0
Envoy Passport 2.2.5
7.8
CVSSv3
CVE-2018-17500
Envoy Passport for Android and Envoy Passport for iPhone could allow a local malicious user to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information.
Envoy Passport 2.4.0
Envoy Passport 2.2.5
7.5
CVSSv3
CVE-2021-28683
An issue exists in Envoy up to and including 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.
Envoyproxy Envoy 1.17.1
Envoyproxy Envoy 1.16.2
5.3
CVSSv3
CVE-2020-25752
An issue exists on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passwords for these accounts are hardcoded values derived from the MD5 hash of the username and serial number mixed with some static s...
Enphase Envoy Firmware D4.0
Enphase Envoy Firmware R3.0
7.5
CVSSv3
CVE-2020-25754
An issue exists on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retriev...
Enphase Envoy Firmware D4.0
Enphase Envoy Firmware R3.0
8.6
CVSSv3
CVE-2021-39162
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an up...
Envoyproxy Envoy 1.19.0
Pomerium Pomerium 0.15.0
Envoyproxy Envoy
9.8
CVSSv3
CVE-2020-25753
An issue exists on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml.
Enphase Envoy Firmware D4.0
Enphase Envoy Firmware R3.0
8.8
CVSSv3
CVE-2020-25755
An issue exists on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter.
Enphase Envoy Firmware D4.0
Enphase Envoy Firmware R3.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-23692
CVE-2012-1823
memory leak
CVE-2024-0627
CVE-2024-31402
privilege escalation
CVE-2024-36418
remote code execution
CVE-2024-27844
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »