CVE-2024-39900 OpenSearch Dashboards Reports does not properly restrict access to private tenant resources

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when...

CVE-2024-39901 OpenSearch Observability does not properly restrict access to private tenant resources

OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when...

PT-2024-28718 · Unknown +1 · Opensearch +1

Name of the Vulnerable Software and Affected Versions: OpenSearch versions prior to 2.14 Description: An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessi...

OpenSearch Dashboards Reports Security Vulnerability

OpenSearch Dashboards Reports is an OpenSearch open source application. It is used to export and automate PNG, PDF and CSV reports in OpenSearch Dashboard. A security vulnerability exists in OpenSearch Dashboards Reports prior to version 2.14, which stems from the system not properly checking if ...

F5 Networks BIG-IP : glibc vulnerability (K49921213)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K49921213 advisory. - A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was...

CVE-2023-30900

A vulnerability has been identified in Xpedition Layout Browser All versions VX.2.14. Affected application contains a stack overflow vulnerability when parsing a PCB file. An attacker can leverage this vulnerability to execute code in the context of the current process...

WordPress Plugin BestWebSoft Twitter 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2023-17883 · Chatwoot · Chatwoot

Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.14.0 Description: The issue is related to Cross-site Scripting XSS - DOM, which allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control...

SUSE CVE-2007-0650

Buffer overflow in the opensty function in mkind.c for makeindex 2.14 in teTeX might allow user-assisted remote attackers to overwrite files and possibly execute arbitrary code via a long filename. NOTE: other overflows exist but might not be exploitable, such as a heap-based overflow in the...

SUSE CVE-2012-5829

Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors...

AZL-34839 CVE-2022-32149 affecting package keda for versions less than 2.14.0-1

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...

CVE-2021-46557

Vicidial 2.14-783a was discovered to contain a cross-site scripting XSS vulnerability via the input tabs...

CVE-2021-46557

Vicidial 2.14-783a was discovered to contain a cross-site scripting XSS vulnerability via the input tabs...

Cross site scripting

Vicidial 2.14-783a was discovered to contain a cross-site scripting XSS vulnerability via the input tabs...

log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...

Amazon Linux AMI : ruby24 (ALAS-2021-1501)

The version of ruby24 installed on the remote host is prior to 2.4.10-2.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1501 advisory. The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-tri...

CVE-2021-3328

An issue was discovered in Aprelium Abyss Web Server X1 2.12.1 and 2.14. A crafted HTTP request can lead to an out-of-bounds read that crashes the application...

FIN8 Resurfaces with Revamped Backdoor Malware

The FIN8 cyberattack group has resurfaced after a period of relative quiet, researchers have found. The gang is using new versions of the BadHatch backdoor to compromise companies in the chemical insurance, retail and technology industries. The attacks have been seen hitting organizations around...

GHSA-XCF7-CJ8Q-PCJM XSS vulnerability in Author URL of themes in Mautic

Impact An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes. Patches Update to 2.14 or later Workarounds None References https://github.com/mautic/mautic/releases/tag/2.14.0 For more information If you have any questions or comments about this advisory: Email us at...

XSS vulnerability in Author URL of themes in Mautic

Impact An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes. Patches Update to 2.14 or later Workarounds None References https://github.com/mautic/mautic/releases/tag/2.14.0 For more information If you have any questions or comments about this advisory: Email us at...