142 matches found
CVE-2022-39342 OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose model has a relation defined as a tupleset the right hand side of a ‘from’ statement that involves anything other than a direct relationship...
PT-2022-24911 · Openfga · Openfga
Name of the Vulnerable Software and Affected Versions: OpenFGA versions prior to 0.2.4 Description: OpenFGA is an authorization/permission engine. The issue allows for authorization bypass under certain conditions, specifically when users have a wildcard defined on tupleset relations in their...
OpenFGA 安全漏洞
OpenFGA is OpenFGA's high performance and flexible authorization/licensing engine built for developers and inspired by Google Zanzibar. A security vulnerability exists in versions of OpenFGA prior to 0.2.4, which stems from the ease of bypassing authorization under certain circumstances...
PT-2022-24912 · Openfga · Openfga
Name of the Vulnerable Software and Affected Versions: OpenFGA versions prior to 0.2.4 Description: OpenFGA is an authorization/permission engine. The issue concerns authorization bypass under certain conditions, specifically when a relation is defined as a tupleset involving anything other than ...
CVE-2022-39341
OpenFGA (authorization engine) is affected by CVE-2022-39341. Versions prior to 0.2.4 are vulnerable to an authorization bypass when a wildcard (*) is defined on tupleset relations in the authorization model. The issue is fixed in version 0.2.4, which contains the patch. Affected product/componen...
[SECURITY] Fedora 36 Update: meg-0.2.4-6.fc36
Fetch many paths for many hosts without killing the hosts...
CVE-2022-1275 BannerMan <= 0.2.4 - Multiple Admin+ Stored Cross-Site Scripting
The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks when the unfilteredhtml is disallowed such as in multisite...
gfbgraph security update
0.2.4-1 - Update to 0.2.4 Resolves: 1997941...
gfbgraph: missing TLS certificate verification
In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...
gfbgraph security update
An update is available for gfbgraph. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GLib/GObject wrapper for the Facebook Graph API that integrates with GNOME...
10tcl (>=0.0.1 <=0.0.10), 20231122-npm (=1.0.0) +6535 more potentially affected by CVE-2013-7371 via connect (>=0.2.4 <=2.8.1)
connect NPM version =0.2.4, =0.0.1, =0.0.1, =1.0.0, =0.0.1, =0.0.0, =2.0.0, =0.20.0, =1.0.1, =0.0.1, =0.0.1, =1.0.13-beta.10 and more Source cves: CVE-2013-7371 Source advisory: OSV:GHSA-6W62-83G6-RFHJ...
GHSA-XVCH-5GV4-984H Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95...
Route16 (=0.0.1), adblock (>=0.1.0 <=0.1.18) +146 more potentially affected by unknown CVE via rental (>=0.2.4 <=0.5.6)
rental CARGO version =0.2.4, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.2.0, =0.12.0, =0.5.0, =0.1.0, =0.7.0, =0.5.0, =0.7.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0134...
WordPress 安全漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin WP Attachment Export prior to version 0.2.4...
keeshond_editor (>=0.1.0 <=0.9.0) potentially affected by CVE-2021-28028 +1 more via toodee (=0.2.4)
toodee CARGO version =0.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on toodee and may be impacted: - keeshondeditor =0.1.0, =0.9.0 Source cves: CVE-2021-28028, CVE-2021-28029 Source advisory: OSV:GHSA-XM9M-2VJ8-FMFR...
keeshond_editor (>=0.1.0 <=0.9.0) potentially affected by CVE-2021-28028 +1 more via toodee (=0.2.4)
toodee CARGO version =0.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on toodee and may be impacted: - keeshondeditor =0.1.0, =0.9.0 Source cves: CVE-2021-28028, CVE-2021-28029 Source advisory: OSV:GHSA-WCVP-R8J8-47PC...
RPCBind <= 0.2.4 DoS Vulnerability
RPCBind is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...
UBUNTU-CVE-2020-36241
autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location...
Malicious Package in jquery-airload
Version 0.2.5 of jquery-airload contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...