Security: Medium and Low Findings

#39 opened 2026-05-06 10:46:26 -05:00 by pjennings

[MEDIUM] Undocumented Windows host at 10.1.11.254 with NetBIOS exposure

area:network

type:investigation

#38 opened 2026-05-06 10:46:25 -05:00 by pjennings

[MEDIUM] Missing security headers and server info leakage on web services

#34 opened 2026-05-05 17:51:44 -05:00 by pjennings

[MEDIUM] Undocumented hosts discovered on 10.1.12.x subnet

area:network

type:investigation

#33 opened 2026-05-05 17:51:43 -05:00 by pjennings

[HIGH] LLMNR enabled on hosts — vulnerable to MITM/credential harvesting

area:network

#32 opened 2026-05-05 17:51:43 -05:00 by pjennings

[HIGH] Cockpit admin panel exposed on port 9090 (ai1/cortex)

#31 opened 2026-05-05 17:51:42 -05:00 by pjennings

[LOW] Some services lack health checks for automatic recovery

area:infrastructure

priority:low

#30 opened 2026-05-05 15:45:01 -05:00 by pjennings

[LOW] Mesh network status script world-readable with topology info

priority:low

#29 opened 2026-05-05 15:45:01 -05:00 by pjennings

[LOW] WireGuard public keys committed to repository

priority:low

#28 opened 2026-05-05 15:45:01 -05:00 by pjennings

[MEDIUM] Public-facing file upload endpoints have no size limits

#27 opened 2026-05-05 15:44:48 -05:00 by pjennings

[MEDIUM] Docker SSH force command uses eval for command execution

#26 opened 2026-05-05 15:44:48 -05:00 by pjennings

[MEDIUM] ACME PFX certificates exported with empty password

#25 opened 2026-05-05 15:44:47 -05:00 by pjennings

[MEDIUM] No documented secret rotation procedure

#24 opened 2026-05-05 15:44:47 -05:00 by pjennings

[MEDIUM] OCIS disables OIDC access token verification

#23 opened 2026-05-05 15:44:47 -05:00 by pjennings

[MEDIUM] allowNoPasswordLogin enabled on all hosts