Opptrix
Monthly
Denial of service in Travisun Opptrix 0.4.0 is reachable through the /api/channels/webhook/ route, where the preParsing handler's use of Buffer.concat can be driven into improper resource handling (CWE-404). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the route is remotely reachable by unauthenticated attackers with no user interaction, but the assessed impact is deliberately narrow: low availability loss only, with no confidentiality or integrity consequence. A public PoC reference exists but is not verified as working exploit code, and realistic exposure is sharply limited because the maintainer has taken the project offline and deprecated it, states the flaw manifested primarily in local environments during early development, and says the main versions were intended to run exclusively on localhost.
Code injection in Travisun Opptrix 0.4.0 through the /api/system-update/import endpoint can lead to remote code execution by an unauthenticated network attacker when the HTTP API is reachable. The independent assessment rates confidentiality, integrity, and availability impact as high, but practical exposure is constrained because the deprecated project was intended to run only on localhost and remote exploitation requires an operator to expose the API on a routable interface. The supplied intelligence does not confirm CISA KEV active exploitation, and a public PoC reference exists but is not verified as working exploit code.
Unauthenticated command injection in Travisun Opptrix 0.4.0 allows remote attackers to run arbitrary commands on the host by manipulating the /api/auth/setup endpoint of the project's Schedule API. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) and the independent assessment agree that no credentials or user interaction are needed, and the impact is scoped to the vulnerable component with low confidentiality, integrity and availability effect in the vendor score but high across all three in our assessment. A public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation. Real-world priority remains low: the maintainer says the project was meant to run only on localhost, it is deprecated and completely taken offline, and only unsupported versions are affected, which is why this is tracked as a this_month item rather than an emergency.
Denial of service in Travisun Opptrix 0.4.0 is reachable through the /api/channels/webhook/ route, where the preParsing handler's use of Buffer.concat can be driven into improper resource handling (CWE-404). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the route is remotely reachable by unauthenticated attackers with no user interaction, but the assessed impact is deliberately narrow: low availability loss only, with no confidentiality or integrity consequence. A public PoC reference exists but is not verified as working exploit code, and realistic exposure is sharply limited because the maintainer has taken the project offline and deprecated it, states the flaw manifested primarily in local environments during early development, and says the main versions were intended to run exclusively on localhost.
Code injection in Travisun Opptrix 0.4.0 through the /api/system-update/import endpoint can lead to remote code execution by an unauthenticated network attacker when the HTTP API is reachable. The independent assessment rates confidentiality, integrity, and availability impact as high, but practical exposure is constrained because the deprecated project was intended to run only on localhost and remote exploitation requires an operator to expose the API on a routable interface. The supplied intelligence does not confirm CISA KEV active exploitation, and a public PoC reference exists but is not verified as working exploit code.
Unauthenticated command injection in Travisun Opptrix 0.4.0 allows remote attackers to run arbitrary commands on the host by manipulating the /api/auth/setup endpoint of the project's Schedule API. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, E:P) and the independent assessment agree that no credentials or user interaction are needed, and the impact is scoped to the vulnerable component with low confidentiality, integrity and availability effect in the vendor score but high across all three in our assessment. A public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation. Real-world priority remains low: the maintainer says the project was meant to run only on localhost, it is deprecated and completely taken offline, and only unsupported versions are affected, which is why this is tracked as a this_month item rather than an emergency.