Code injection

Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link...

Palantir Security Breach

Palantir is a data platform from US-based Palantir that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in Palantir Gotham that stems from the presence of a front-end UI error that causes newly...

CVE-2023-30961 Palantir Gotham UI bug that could lead to incorrect data classification

Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link...

CVE-2023-30961

Palantir Gotham UI bug: the frontend could misclassify a newly created property or link under certain conditions. Affected are gotham-fe-bundle versions prior to 100.30230706.22, 100.30230702.24, 100.30230704.15, and 100.30230702.0. Public sources describe a front‑end UI error causing incorrect c...

CVE-2023-30961 Palantir Gotham UI bug that could lead to incorrect data classification

Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link...

PT-2023-23090 · Palantir · Palantir Gotham

Name of the Vulnerable Software and Affected Versions: Palantir Gotham affected versions not specified Description: A bug was discovered in Palantir Gotham where the frontend could apply an incorrect classification to a newly created property or link under certain circumstances. Recommendations: ...

CVE-2023-30961: Improper Adherence to Coding Standards

Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link...

CVE-2023-30962

The Gotham Cerberus service was found to have a stored cross-site scripting XSS vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58...

CVE-2023-30962

The Gotham Cerberus service was found to have a stored cross-site scripting XSS vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58...

Cross site scripting

The Gotham Cerberus service was found to have a stored cross-site scripting XSS vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58...

CVE-2023-30962 Stored XSS in cerberus attachments

The Gotham Cerberus service was found to have a stored cross-site scripting XSS vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58...

Palantir Gotham Cerberus Cross-Site Scripting Vulnerability

Palantir Gotham Cerberus is a simple Web-based spreadsheet editor from Palantir USA. It has a real-time collaboration feature that validates input against existing data. A security vulnerability exists in the Gotham Cerberus service that stems from the presence of a stored cross-site scripting XS...

CVE-2023-30962: Unrestricted Upload of File with Dangerous Type

The Gotham Cerberus service was found to have a stored cross-site scripting XSS vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58...

PT-2023-23091 · Unknown · Gotham Cerberus

Name of the Vulnerable Software and Affected Versions: Gotham Cerberus versions prior to 100.230704.0-27-g031dd58 Description: The Gotham Cerberus service has a stored cross-site scripting XSS issue that could allow an attacker with access to Gotham to launch attacks against other users...

CVE-2022-27892

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service...

CVE-2022-27897

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server...

CVE-2022-48306

Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept...

CVE-2022-27892

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service...

CVE-2022-27891

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected servic...

CVE-2022-27897

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server...