Vendor
ConvoyPanel
2 known vulnerabilities.
Products
2 results · Clear filters · Feed
-
Critical 9.8
Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 sign…
-
Critical 10.0
Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution
Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vul…