fuxa-server (npm)
Advisories
22
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.3.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install fuxa-server@1.3.1yarn
yarn add fuxa-server@1.3.1pnpm
pnpm add fuxa-server@1.3.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8ghr-w65f-j3qr FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions |
Medium EPSS 0.43% |
<= 1.1.14-1243 | No fix yet |
| GHSA-h9fj-c2qr-76g2 FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString |
Medium EPSS 0.64% |
<= 1.1.14-1243 | No fix yet |
| GHSA-w86f-rf9w-h3x6 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading |
High EPSS 0.59% |
<= 1.1.14-1243 | No fix yet |
| GHSA-r9g5-7q8j-958c FUXA provides guest and invalid-token access to protected read APIs in secure mode |
Medium EPSS 0.46% |
>= 1.3.0-2773, < 1.3.1 | 1.3.1 |
| GHSA-q3w6-q3hc-c5x6 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations |
High EPSS 1.38% |
>= 1.3.0, < 1.3.1 | 1.3.1 |
| GHSA-rg3m-cfq7-g6h6 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass |
High EPSS 0.91% |
>= 1.3.0, < 1.3.1 | 1.3.1 |
| GHSA-fwcm-rqvw-j3p7 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue |
High EPSS 0.57% |
>= 1.3.0, < 1.3.1 | 1.3.1 |
| GHSA-68m5-5w2h-h837 FUXA Affected by a Path Traversal Sanitization Bypass |
High EPSS 1.38% |
< 1.2.11 | 1.2.11 |
| GHSA-c869-jx4c-q5fc FUXA Unauthenticated Remote Arbitrary Scheduler Write |
Critical EPSS 12.72% |
>= 1.2.8, < 1.2.11 | 1.2.11 |
| GHSA-v4p5-w6r3-2x4f FUXA Unauthenticated Remote Code Execution in Node-RED Integration |
Critical EPSS 1.07% |
>= 1.2.8, < 1.2.11 | 1.2.11 |
| GHSA-ggxw-g3cp-mgf8 FUXA Unauthenticated Remote Arbitrary Device Tag Write |
Critical EPSS 0.54% |
< 1.2.10 | 1.2.10 |
| GHSA-88qh-cphv-996c FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API |
Critical EPSS 13.03% |
< 1.2.10 | 1.2.10 |
| GHSA-32cc-x95p-fxcg FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration |
Critical EPSS 0.85% |
< 1.2.10 | 1.2.10 |
| GHSA-c5gq-4h56-4mmx FUXA Unauthenticated Exposure of Plaintext Database Credentials |
High EPSS 0.30% |
< 1.2.10 | 1.2.10 |
| GHSA-vwcg-c828-9822 FUXA Unauthenticated Remote Code Execution via Admin JWT Minting |
Critical EPSS 0.77% |
< 1.2.10 | 1.2.10 |
| GHSA-2r8f-cf6w-x5vq Duplicate Advisory: FUXA contains a hard-coded credential vulnerability Withdrawn |
High | <= 1.2.7 | No fix yet |
| GHSA-5r63-q8hg-p8qx FUXA allows Remote Code Execution (RCE) via the project import functionality. |
Critical EPSS 0.50% |
<= 1.2.7 | No fix yet |
| GHSA-7g56-fwxj-cm23 FUXA contains an Unrestricted File Upload vulnerability |
Critical EPSS 0.81% |
<= 1.2.7 | No fix yet |
| GHSA-r5m2-fqcf-qrf7 FUXA contains an insecure default configuration vulnerability |
Critical EPSS 0.52% |
<= 1.2.7 | No fix yet |
| GHSA-p46g-8c3q-89p2 FUXA SQL Injection vulnerability |
Critical EPSS 44.09% |
<= 1.1.12 | No fix yet |
| GHSA-wwfj-h843-3hrq FUXA local file inclusion vulnerability |
High EPSS 1.73% |
<= 1.1.12 | No fix yet |
| GHSA-v9q5-9crp-92f9 FUXA SQL Injection vulnerability |
High EPSS 1.84% |
<= 1.1.12 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor