PT-2024-32805

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 15.13.99.113 Tuleap Enterprise Edition versions prior to 15.13-5 Tuleap Enterprise Edition versions prior to 15.12-8 Description Tuleap is a tool for end to end traceability of application and system...

PT-2024-32322 · Unknown · Tuleap Community Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 15.13.99.40 Tuleap Enterprise Edition versions prior to 15.13-3 Tuleap Enterprise Edition versions prior to 15.12-6 Description: Tuleap is a tool for end to end traceability of application and system...

Fedora 40 : redis (2024-5d4eb04e76)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5d4eb04e76 advisory. Redis Community Edition 7.2.6 Released Wed 02 Oct 2024 20:17:04 IDT Upgrade urgency SECURITY: See security fixes below. Security fixes CVE-2024-3144...

Fedora 39 : redis (2024-68f9c0741f)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-68f9c0741f advisory. Redis Community Edition 7.2.6 Released Wed 02 Oct 2024 20:17:04 IDT Upgrade urgency SECURITY: See security fixes below. Security fixes CVE-2024-3144...

GO-2024-3191 Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault

Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault...

BIT-DISCOURSE-2024-45051 Bypass of email address validation via encoded email addresses in Discourse

Discourse is an open source platform for community discussion. A maliciously crafted email address could allow an attacker to bypass domain-based restrictions and gain access to private sites, categories and/or groups. This issue has been patched in the latest stable, beta and tests-passed versio...

BIT-DISCOURSE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...

BIT-DISCOURSE-2024-47772 Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a maliciously crafted chat message and replying to it. This issue only affects sites with CSP disabled. This problem is patched in the latest version of...

BIT-DISCOURSE-2024-47773 Anonymous cache poisoning via XHR requests in Discourse

Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse...

Vulnerabilities fixed in Gitlab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in Enterprise Edition EE and Community Edition CE. A malicious party could exploit the vulnerabilities to cause a denial-of-service, gain access to sensitive data, or execute code in the context of another user, potentially including users with administrator...

New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution

GitLab has released security updates for Community Edition CE and Enterprise Edition EE to address eight security flaws, including a critical bug that could allow running Continuous Integration and Continuous Delivery CI/CD pipelines on arbitrary branches. Tracked as CVE-2024-9164, the...

Vault Community Edition privilege escalation vulnerability

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

GHSA-RR8J-7W34-XP5J Vault Community Edition privilege escalation vulnerability

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

CVE-2024-9180 Vault Operators in Root Namespace May Elevate Their Privileges

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass due to improper handling of sensitive information. An attacker with administrative privileges can bypass security features, leading to a low impact on...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass allowing a low-privileged attacker to bypass security measures and achieve unauthorized access by exploiting these settings. Remediation Upgrade...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization allowing a low-privileged attacker could bypass security measures and impact confidentiality and integrity without user interaction. Remediation...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. An attacker with administrative privileges can bypass security measures and impact data integrity by exploiting this vulnerability. Remediation Upgra...

Information Exposure

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Information Exposure. An attacker can bypass security features and potentially access sensitive information by exploiting this vulnerability without requiring user...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization allowing a low-privileged attacker to escalate privileges and bypass security measures to affect confidentiality without user interaction. Remediatio...