KongHQ records
6 published records for vendor konghq.
Researcher profile
- Entered KEV
- 1 · 16.7%
- Weaponized
- 1 · 16.7%
- Pre-auth RCE
- 0
- With a fix record
- 33.3%
- Median publish → KEV
- 0 days
Recurring classes
- CWE-114 Process Control1
- CWE-1333 Inefficient Regular Expression Complexity1
- CWE-330 Use of Insufficiently Random Values1
- CWE-400 Uncontrolled Resource Consumption1
- CWE-706 Use of Incorrectly-Resolved Name or Reference1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
Bug bounty scope
The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.
All records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
90Now | CVE-2023-44487Weaponized | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, assiemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware · CWE-400 | High7.5 | KEV | 99.9% | Oct 10, 2023 |
49Plan | CVE-2020-11710Proof of concept | An issue was discovered in docker-kong (for Kong) through 2.0.3.konghq · docker-kong | Critical9.8 | — | 33.1% | Apr 12, 2020 |
31Monitor | CVE-2021-27306No exploit | An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authentickonghq · kong gateway · CWE-706 | High7.5 | — | 1.7% | Mar 18, 2021 |
31Monitor | CVE-2023-40299No exploit | Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by usingkonghq · insomnia · CWE-114 | High7.8 | — | 0.4% | Oct 4, 2023 |
30Monitor | CVE-2020-36661No exploit | Kong lua-multipart multipart.lua is_header redoskonghq · multipart · CWE-1333 | High7.5 | — | 0.9% | Feb 12, 2023 |
23Monitor | CVE-2023-2418No exploit | Konga Login API random valueskonghq · kong · CWE-330 | Medium5.9 | — | 0.7% | Apr 28, 2023 |
- CVE-2023-4448790Now
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as
HighCVSS 7.5KEVWeaponizedEPSS 99%siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023
- CVE-2020-1171049Plan
An issue was discovered in docker-kong (for Kong) through 2.0.3.
CriticalCVSS 9.8Proof of conceptEPSS 33%konghq · docker-kongApr 12, 2020
- CVE-2021-2730631Monitor
An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authentic
HighCVSS 7.5No exploitEPSS 1%konghq · kong gatewayMar 18, 2021
- CVE-2023-4029931Monitor
Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using
HighCVSS 7.8No exploitEPSS 0%konghq · insomniaOct 4, 2023
- CVE-2020-3666130Monitor
Kong lua-multipart multipart.lua is_header redos
HighCVSS 7.5No exploitEPSS 0%konghq · multipartFeb 12, 2023
- CVE-2023-241823Monitor
Konga Login API random values
MediumCVSS 5.9No exploitEPSS 0%konghq · kongApr 28, 2023