CVE-2023-31997

CRITICAL Year: 2023
CVSS v3 Score
9.0
Critical
Weakness Type
CWE-863
View all →

Vulnerability Description

UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that are both (1) running UniFi OS 3.1 and (2) hosting the UniFi Network application. "Applicable Cloud Keys" include the following: Cloud Key Gen2 and Cloud Key Gen2 Plus.

Related Vulnerabilities

CVE-2025-30171

HIGH
CVSS:9.0(Critical)

System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3....

CWE-8632025

CVE-2010-2548

CRITICAL
CVSS:9.1(Critical)

IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.

CWE-8632010

CVE-2013-1350

CRITICAL
CVSS:9.1(Critical)

Verax NMS prior to 2.1.0 has multiple security bypass vulnerabilities

CWE-8632013

CVE-2018-7245

CRITICAL
CVSS:9.1(Critical)

An improper authorization vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the...

CWE-8632018

CVE-2020-7692

CRITICAL
CVSS:9.1(Critical)

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee...

CWE-8632020

CVE-2021-26040

CRITICAL
CVSS:9.1(Critical)

An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command.

CWE-8632021