Vendor
Termix-SSH
26 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
Medium 5.3
Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentica…
-
Medium 5.5
Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public…
-
Medium 4.3
Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled creden…
-
Medium 6.6
Termix: Command injection in SSH key deployment verification
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into do…
-
Medium 5.4
Termix: Authenticated users can read other users' host status and clear global SSH connections
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for h…
-
Medium 6.4
Termix: Authenticated blind SSRF through notification channel test endpoints
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URL…