CVE-2024-22278

Incorrect user permission validation in Harbor v2.9.5 and Harbor v2.10.3 allows authenticated users to modify configurations...

CVE-2024-22278

CVE-2024-22278 concerns Harbor where incorrect user permission validation in Harbor <v2.9.5 and Harbor

CVE-2024-22278 Harbor fails to validate the user permissions when updating project configurations

Incorrect user permission validation in Harbor v2.9.5 and Harbor v2.10.3 allows authenticated users to modify configurations...

CVE-2024-22278 Harbor fails to validate the user permissions when updating project configurations

Incorrect user permission validation in Harbor v2.9.5 and Harbor v2.10.3 allows authenticated users to modify configurations...

Harbor 安全漏洞

Harbor is an open source registry from Harbor Open Source. Artifacts are protected through policy and role-based access control, ensuring that images are scanned and free of vulnerabilities, and signing images as trusted. A security vulnerability exists in Harbor versions prior to 2.9.5 and prior...

PT-2024-9517 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication versions prior to 12.2 Description: A vulnerability in Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability...

Improper Permission Validation

github.com/goharbor/harbor is vulnerable to Improper Permission Validation. The vulnerability is due to the failure to validate maintainer role permissions when updating project configurations. Attackers can exploit this by sending requests to create, update, or delete metadata in a project they ...

Rockwell Automation ControlLogix 安全漏洞

Rockwell Automation ControlLogix is a controller from Rockwell Automation. A security vulnerability exists in Rockwell Automation ControlLogix that stems from a bypass issue where an attacker may be able to execute CIP commands to modify user items or device configurations on the controller...

PT-2024-5335

Name of the Vulnerable Software and Affected Versions Rockwell Automation 1756-EN4TR, 1756-EN2T Series A/B/C, 1756-EN2F Series A/B, 1756-EN2TR Series A/B, 1756-EN3TR Series B, 1756-EN2T Series D, 1756-EN2F Series C, 1756-EN2TR Series C, 1756-EN3TR Series B, 1756-EN2TP Series A Description A...

CVE-2024-41256

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack...

GHSA-HW28-333W-QXP3 Harbor fails to validate the user permissions when updating project configurations

Impact Harbor fails to validate the maintainer role permissions when creating/updating/deleting project configurations - API call: - PUT /projects/projectnameorid/metadatas/metaname - POST /projects/projectnameorid/metadatas/metaname - DELETE /projects/projectnameorid/metadatas/metaname By sendin...

Harbor fails to validate the user permissions when updating project configurations

Impact Harbor fails to validate the maintainer role permissions when creating/updating/deleting project configurations - API call: - PUT /projects/projectnameorid/metadatas/metaname - POST /projects/projectnameorid/metadatas/metaname - DELETE /projects/projectnameorid/metadatas/metaname By sendin...

CVE-2024-41256

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack...

CVE-2024-41256

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack...

CVE-2024-5807

The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations...

CVE-2024-5807

The Business Card WordPress plugin (versions

CVE-2024-5807 Business Card <= 1.0.0 - Admin+ File Upload

The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations...

PT-2024-41005 · Kubevirt · Kubevirt

Name of the Vulnerable Software and Affected Versions: kubevirt versions prior to 1.2.2 Description: The issue is related to an update for kubevirt and several other virt containers, which fixes various issues, including an update to version 1.2.2 and the use of predefined configuration files for...

CVE-2024-41676

Magento-lts is a long-term support alternative to Magento Community Edition CE. This XSS vulnerability affects the design/header/welcome, design/header/logosrc, design/header/logosrcsmall, and design/header/logoalt system configs.They are intended to enable admins to set a text in the two cases,...

PT-2024-29501 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento-lts versions prior to 20.10.1 Description: This issue affects the design/header/welcome, design/header/logo src, design/header/logo src small, and design/header/logo alt system configs, which are intended to enable admins to set a tex...