https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 06:18:23 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-06224 bdu:2023-06224 https://cve.radiocsirt.org/vuln/bdu:2023-06224 https://cve.radiocsirt.org/vuln/euvd-2026-188192 EUVD-2026-188192 https://cve.radiocsirt.org/vuln/euvd-2026-188192 https://cve.radiocsirt.org/vuln/fkie_cve-2023-42442 <p>JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).</p> <p>JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not affected. The api `/api/v1/terminal/sessions/` permission control is broken and can be accessed anonymously. SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. Versions 3.5.5 and 3.6.4 have a fix. After upgrading, visit the api `$HOST/api/v1/terminal/sessions/?limit=1`. The expected http response code is 401 (`not_authenticated`).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-42442 https://cve.radiocsirt.org/vuln/gsd-2023-42442 gsd-2023-42442 https://cve.radiocsirt.org/vuln/gsd-2023-42442