Vendor
BlueWave
10 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
High 7.1
Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance w…
-
High 7.5
Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticat…
-
High 7.5
Checkmate: Pre-auth Denial of Service via File Upload on Registration
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes…
-
High 8.1
Mass Assignment Privilege Escalation in Checkmate
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. In versions from 3.5.1 and prior, a mass assignment vulnerability in Checkmate's use…
-
High 8.8
In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.
-
High 8.1
In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.