Vulnerabilities of n/a NGINX Controller
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2021-23021 | The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with… | Not rated | Jun 1, 2021 |
| CVE-2021-23020 | The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which… | Not rated | Jun 1, 2021 |
| CVE-2021-23019 | The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt… | Not rated | Jun 1, 2021 |
| CVE-2021-23018 | Intra-cluster communication does not use TLS | Not rated | Jun 1, 2021 |
| CVE-2020-27730 | In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling… | Not rated | Dec 11, 2020 |
| CVE-2020-5909 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface… | Not rated | Jul 2, 2020 |
| CVE-2020-5910 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in… | Not rated | Jul 2, 2020 |
| CVE-2020-5911 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes… | Not rated | Jul 2, 2020 |
| CVE-2020-5901 | In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack | Not rated | Jul 1, 2020 |
| CVE-2020-5899 | In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the… | Not rated | Jul 1, 2020 |
| CVE-2020-5900 | In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for… | Not rated | Jul 1, 2020 |
| CVE-2020-5895 | On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which… | Not rated | May 7, 2020 |
| CVE-2020-5894 | On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users… | Not rated | May 7, 2020 |
| CVE-2020-5867 | In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check… | Not rated | Apr 23, 2020 |
| CVE-2020-5866 | In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to… | Not rated | Apr 23, 2020 |
| CVE-2020-5864 | In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS… | Not rated | Apr 23, 2020 |
| CVE-2020-5865 | In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over… | Not rated | Apr 23, 2020 |
| CVE-2020-5863 | In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can… | Not rated | Mar 27, 2020 |
Other n/a products
n/a 144660
Android 2441
kernel 279
Open5GS 125
Intel(R) Processors 119
BIG-IP 110
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions 106
HPE Intelligent Management Center (IMC) PLAT 105
Moodle 89
Aruba ClearPass Policy Manager 83
GPAC 80
postgresql 79