Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
nats nats server vulnerabilities and exploits
(subscribe to this query)
8.8
CVSSv3
CVE-2022-24450
NATS nats-server prior to 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
Nats Nats Streaming Server
Nats Nats Server
3 Github repositories
6.5
CVSSv3
CVE-2022-26652
NATS nats-server prior to 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server prior to 0.24.3 is also affected.
Nats Nats Server
Nats Nats Streaming Server
3 Github repositories
7.5
CVSSv3
CVE-2023-46129
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is us...
Nats Nkeys
Nats Nats Server
7.5
CVSSv3
CVE-2021-3127
NATS Server 2.x prior to 2.2.0 and JWT library prior to 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
Nats Jwt Library
Nats Nats Server
7.5
CVSSv3
CVE-2020-28466
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users pre...
Nats Nats Server
7.5
CVSSv3
CVE-2019-13126
An integer overflow in NATS Server prior to 2.0.2 allows a remote malicious user to crash the server by sending a crafted request. If authentication is enabled, then the remote attacker must have first authenticated.
Nats Nats Server
6.5
CVSSv3
CVE-2023-47090
NATS nats-server prior to 2.9.23 and 2.10.x prior to 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earlies...
Linuxfoundation Nats-server
9.8
CVSSv3
CVE-2022-28357
NATS nats-server 2.2.0 up to and including 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.
Linuxfoundation Nats-server
7.5
CVSSv3
CVE-2020-26521
The JWT library in NATS nats-server prior to 2.1.9 allows a denial of service (a nil dereference in Go code).
Linuxfoundation Nats-server
Fedoraproject Fedora 33
9.8
CVSSv3
CVE-2020-26892
The JWT library in NATS nats-server prior to 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
Linuxfoundation Nats-server
Fedoraproject Fedora 33
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4367
CVE-2024-35977
CVE-2023-49335
man-in-the-middle
CVE-2024-4947
CVE-2024-31714
memory leak
SQL
CVE-2024-35994
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »