PS Positive Security GmbH

Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint

Agent receiver accepts mTLS requests without a client certificate

Insufficient permission validation on multiple REST API Quick Setup endpoints

Insufficient permission validation when showing agent information

Insufficient permission validation on multiple REST API endpoints

Insufficient permission validation when configuring notification parameters

local IP restriction of internal HTTP endpoints

Livestatus injection in autocomplete endpoint

Arbitrary file write with vcrtrace

Reflected links in visuals facilitate phishing attacks