GHSA-5FC3-PQF2-57CX Apache IoTDB Discloses Sensitive Information via Log Files

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version...

The vulnerability of the CassandraNetworkAuthorizer and CassandraCIDRAuthorizer components of the distributed Apache Cassandra database management system allows attackers to enhance their privileges.

The vulnerability of the CassandraNetworkAuthorizer and CassandraCIDRAuthorizer components of the distributed Apache Cassandra database management system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to enhance their...

AZL-56433 CVE-2025-24860 affecting package cassandra 5.0.0-2

Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer. Users with restricted data center access can update their own permissions via data control...

Malicious code in cognito_authorizer (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

PT-2025-5589 · Apache · Apache Cassandra

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 4.0.0 through 4.0.15 Apache Cassandra versions 4.1.0 through 4.1.7 Apache Cassandra versions 5.0.0 through 5.0.2 Description: The issue allows users to access a datacenter or IP/CIDR groups they should not be able to...

Malicious code in jazz_token-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3bd3fcfec7eb7354597369d7c1b2496841dbeabc3876ca1c150802f8bc3221f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-197 Malicious code in jazz_token-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3bd3fcfec7eb7354597369d7c1b2496841dbeabc3876ca1c150802f8bc3221f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-49756 AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.

AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions no changing fields, and would...

PT-2024-31387 · Amazon · Aws Cloud Development Kit

Name of the Vulnerable Software and Affected Versions: AWS Cloud Development Kit CDK versions 2.142.0 through 2.148.0 Description: The issue in AWS Cloud Development Kit CDK can result in granting authenticated Amazon Cognito users broader than intended access. Specifically, if a CDK application...

Temporal UI Server cross-site scripting vulnerability

For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that signal. The XSS is in the timeline page displaying the workflow execution details of the workflow that was sent the crafted signal. Access...

CVE-2024-2435 Stored XSS in Timeline View

For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that signal. The XSS is in the timeline page displaying the workflow execution details of the workflow that was sent the crafted signal. Access...

Malicious code in samsungads-publisher-portal-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3bdf69166b497f7cd30a51ffff97b600796cbf77f8a34ead71e7ed700f40dfc7 The OpenSSF Package Analysis project identified 'samsungads-publisher-portal-authorizer' @ 99999.999.0 npm as malicious. It is considered...

MAL-2024-924 Malicious code in samsungads-publisher-portal-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3bdf69166b497f7cd30a51ffff97b600796cbf77f8a34ead71e7ed700f40dfc7 The OpenSSF Package Analysis project identified 'samsungads-publisher-portal-authorizer' @ 99999.999.0 npm as malicious. It is considered...

Malicious code in f0-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b198073a3c6c8c48eaa78a60790eebe24d1bce34d24bdcbba4e0f077f329c56b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8319 Malicious code in f0-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b198073a3c6c8c48eaa78a60790eebe24d1bce34d24bdcbba4e0f077f329c56b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-38493

CVE-2023-38493 affects Armeria (microservice framework) when used with Spring integration. The issue arises in how matrix variables in paths are handled when Armeria decorates or forwards requests to Spring controllers via TomcatService or JettyService, potentially allowing bypass of the authoriz...

CVE-2023-38493 Paths contain matrix variables bypass decorators

Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via TomcatService or JettyService with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of t...

SUSE CVE-2010-0005

query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypass intended access restrictions via a query...

SUSE CVE-2015-3659

The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cau...

@afiether/gateware-kit (>=1.0.0 <=1.2.18), @afiether/kit (>=1.0.0 <=1.2.17) +42 more potentially affected by CVE-2022-24794 via express-openid-connect (>=0.5.0 <=2.20.2)

express-openid-connect NPM version =0.5.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.0.0, =1.1.6, =1.2.9 and more Source cves: CVE-2022-24794 Source advisory: OSV:GHSA-7P99-3798-F85C...