CVE-2024-35584

SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to...

CVE-2024-35584

SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to...

PT-2024-32322 · Unknown · Tuleap Community Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 15.13.99.40 Tuleap Enterprise Edition versions prior to 15.13-3 Tuleap Enterprise Edition versions prior to 15.12-6 Description: Tuleap is a tool for end to end traceability of application and system...

Fedora 39 : redis (2024-68f9c0741f)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-68f9c0741f advisory. Redis Community Edition 7.2.6 Released Wed 02 Oct 2024 20:17:04 IDT Upgrade urgency SECURITY: See security fixes below. Security fixes CVE-2024-3144...

Fedora 40 : redis (2024-5d4eb04e76)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5d4eb04e76 advisory. Redis Community Edition 7.2.6 Released Wed 02 Oct 2024 20:17:04 IDT Upgrade urgency SECURITY: See security fixes below. Security fixes CVE-2024-3144...

GO-2024-3191 Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault

Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault...

Vulnerabilities fixed in Gitlab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in Enterprise Edition EE and Community Edition CE. A malicious party could exploit the vulnerabilities to cause a denial-of-service, gain access to sensitive data, or execute code in the context of another user, potentially including users with administrator...

New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution

GitLab has released security updates for Community Edition CE and Enterprise Edition EE to address eight security flaws, including a critical bug that could allow running Continuous Integration and Continuous Delivery CI/CD pipelines on arbitrary branches. Tracked as CVE-2024-9164, the...

GHSA-RR8J-7W34-XP5J Vault Community Edition privilege escalation vulnerability

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

Vault Community Edition privilege escalation vulnerability

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

CVE-2024-9180 Vault Operators in Root Namespace May Elevate Their Privileges

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass allowing a low-privileged attacker to bypass security measures and achieve unauthorized access by exploiting these settings. Remediation Upgrade...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization allowing a low-privileged attacker to escalate privileges and bypass security measures to affect confidentiality without user interaction. Remediatio...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass due to improper handling of sensitive information. An attacker with administrative privileges can bypass security features, leading to a low impact on...

Information Exposure

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Information Exposure. An attacker can bypass security features and potentially access sensitive information by exploiting this vulnerability without requiring user...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization allowing a low-privileged attacker could bypass security measures and impact confidentiality and integrity without user interaction. Remediation...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. An attacker with administrative privileges can bypass security measures and impact data integrity by exploiting this vulnerability. Remediation Upgra...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. A low-privileged attacker could bypass security measures and impact system integrity by exploiting this vulnerability without requiring user...

Cross-site Scripting (XSS)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a maliciously crafted URL due to improper user input sanitization. An attacker can execute arbitrary JavaScript in the context of the victim's...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. An attacker can escalate privileges by leveraging the improper access control settings. Remediation Upgrade magento/community-edition to version...