Hawt Hawtio
8 CVEs affecting Hawt Hawtio. Latest disclosed: 2023-06-01. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9827 | Critical | 9.8 | 2019-07-03 | Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the ini… |
CVE-2014-0121 | Critical | 9.8 | 2017-12-29 | The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter. |
CVE-2014-0120 | High | 8.8 | 2017-12-29 | Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for re… |
CVE-2017-7556 | High | 8.8 | 2017-08-17 | Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a… |
CVE-2017-2589 | High | 8.7 | 2018-07-26 | It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally an… |
CVE-2017-2617 | High | 7.6 | 2018-05-22 | hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which cou… |
CVE-2023-33544 | Medium | 5.5 | 2023-06-01 | hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being s… |
CVE-2017-2594 | Medium | 5.4 | 2018-05-08 | hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a ful… |