165 matches found
CVE-2023-22949
TigerGraph Enterprise Free Edition 3.x has a credential leakage issue where all authenticated GSQL access requests are logged, with both username and password included in an easily decodable base64 form. This could allow an administrator with access to logs to harvest usernames and passwords. Aff...
CVE-2023-22951
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token can be read from the configuration file. Using this token on the REST API provides an attacker with anonymous admin-level privileges on all REST API endpoints...
CVE-2023-22948
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. There is unsecured read access to an SSH private key. Any code that runs as the tigergraph user is able to read the SSH private key. With this, an attacker is granted password-less SSH access to all machines in the TigerGraph...
CVE-2023-22950
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsqlserver, created by any user with designer permissions, can read sensitive data from arbitrary locations...
Code injection
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsqlserver, created by any user with designer permissions, can read sensitive data from arbitrary locations...
TigerGraph 安全漏洞
TigerGraph is one of the world's fastest and most scalable graph analytics platforms from the TigerGraph community. Enabling real-time big data graph applications. A security vulnerability exists in TigerGraph Enterprise Free Edition version 3.x. The vulnerability stems from the presence of...
CVE-2023-22948
CVE-2023-22948 affects TigerGraph Enterprise Free Edition 3.x, where an SSH private key is read-accessible by any code running as the tigergraph user. This leads to passwordless SSH access to all machines in the TigerGraph cluster, as described in multiple sources. The root cause is unsecured rea...
CVE-2023-22951
TigerGraph Enterprise Free Edition 3.x stores an internal authentication token in the configuration file. An attacker who can read the config file can use that token on the REST API to obtain anonymous admin-level privileges on all REST API endpoints. The issue is documented across multiple feeds...
CVE-2023-22950
TigerGraph CVE-2023-22950 affects TigerGraph Enterprise Free Edition 3.x. The issue enables data loading jobs in gsql_server, created by any user with designer permissions, to read sensitive data from arbitrary locations. The core impact is sensitive data exposure (confidentiality impact H) with ...
CVE-2021-20874
Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows a remote unauthenticated attacker to access arbitrary files on the server and obtain...
Path traversal
Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on...
CVE-2021-20876
CVE-2021-20876 is a path traversal flaw in GroupSession products (Free edition v5.1.1 and earlier, byCloud v5.1.1 and earlier, ZION v5.1.1 and earlier) that could allow an administrator to access sensitive files outside the web root on the published site via unspecified vectors. The issue affects...
CVE-2021-20875
CVE-2021-20875 is an open redirect vulnerability in GroupSession products (Free edition v5.1.1 and earlier, byCloud v5.1.1 and earlier, ZION v5.1.1 and earlier). The root cause is input validation that allows a specially crafted URL to redirect users to arbitrary sites, enabling phishing when use...
CVE-2021-20789
Open redirect vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacker to redirect a us...
CVE-2021-20787
Cross-site scripting vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacker to inject...
CVE-2021-20788
Server-side request forgery SSRF vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote...
CVE-2021-20785
CVE-2021-20785 is a Cross-site Scripting vulnerability in GroupSession (Japan Total System GroupSession) affecting Free edition (ver2.2.0–pre-5.1.0), GroupSession byCloud (ver3.0.3–pre-5.1.0), and GroupSession ZION (ver3.0.3–pre-5.1.0). The root cause is input handling that allows a remote attack...
JVN#86026700: Multiple vulnerabilities in GroupSession
GroupSession provided by Japan Total System Co.,Ltd. contains multiple vulnerabilities listed below. Cross-site scripting vulnerability CWE-79 - CVE-2021-20785 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2|...