4324 matches found
GHSA-QMJF-WC2H-6X3Q Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects
Impact What kind of vulnerability is it? Who is impacted? A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ to list the...
PYSEC-2024-166
Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...
PT-2024-26899 · Nautobot · Nautobot
Name of the Vulnerable Software and Affected Versions: Nautobot versions 1.3.0 through 1.6.22 Nautobot versions 2.0.0 through 2.2.4 Description: A user with extras.view dynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view...
PT-2024-40536 · Packagist · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A security issue allows a member with the EDIT PERMISSIONS permission and access to the "Security" section to escalate their privileges to ADMIN level by re-assigning themselves or...
Russian Hackers Shift Tactics, Target More Victims with Paid Malware
By Deeba Ahmed Russian hackers and APT groups are escalating cyberattacks, leveraging readily available malware and broadening their targets beyond governments.… This is a post from HackRead.com Read the original post: Russian Hackers Shift Tactics, Target More Victims with Paid Malware...
Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter
GridField does not have sufficient CSRF protection, meaning that in some cases users with CMS access can be tricked into posting unspecified data into the CMS from external websites. Amongst other default CMS interfaces, GridField is used for management of groups, users and permissions in the CMS...
PT-2024-40027 · Silverstripe · Silverstripe Cms
Name of the Vulnerable Software and Affected Versions: Silverstripe CMS affected versions not specified Description: The issue concerns insufficient CSRF protection in GridField, which can be exploited to trick users with CMS access into posting unspecified data from external websites. This affec...
CVE-2024-20361
A vulnerability in the Object Groups for Access Control Lists ACLs feature of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to bypass configured access controls on managed devices that are running Cisco Firepower Threat Defense FTD Software. This...
CVE-2024-20361
Cisco CVE-2024-20361 affects Firepower Management Center (FMC) Software, enabling an unauthenticated remote attacker to bypass access controls on managed Firepower Threat Defense (FTD) devices. The root cause is the incorrect deployment of the Object Groups for ACLs feature from FMC to FTD in hig...
Cisco Firepower Management Center Software Object Group Access Control List Bypass Vulnerability
A vulnerability in the Object Groups for Access Control Lists ACLs feature of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to bypass configured access controls on managed devices that are running Cisco Firepower Threat Defense FTD Software. This...
SUSE CVE-2023-52667
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a potential double-free in fsanycreategroups When kcalloc for ft-g succeeds but kvzalloc for in fails, fsanycreategroups will free ft-g. However, its caller fsanycreatetable will free ft-g again through calling...
SUSE CVE-2024-35835
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfscreategroups When in allocated by kvzalloc fails, arfscreategroups will free ft-g and return an error. However, arfscreatetable, the only caller of arfscreategroups, will hold this error and ca...
SUSE CVE-2024-35956
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Create subvolume, create snapshot and delete subvolume all use btrfssubvolumereservemetadata to reserve metadata for the changes done to the parent subvolume's f...
AZL-67700 CVE-2024-35956 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Create subvolume, create snapshot and delete subvolume all use btrfssubvolumereservemetadata to reserve metadata for the changes done to the parent subvolume's f...
DEBIAN-CVE-2024-35835
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfscreategroups When in allocated by kvzalloc fails, arfscreategroups will free ft-g and return an error. However, arfscreatetable, the only caller of arfscreategroups, will hold this error and ca...
UBUNTU-CVE-2024-35835
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfscreategroups When in allocated by kvzalloc fails, arfscreategroups will free ft-g and return an error. However, arfscreatetable, the only caller of arfscreategroups, will hold this error and ca...
GitLab 12.2 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13275)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 CVE-2020-13275 Note that Nessus has not tested for this issue but...
GitLab 11.3 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39876)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups. CVE-2021-39876 Note that Nessus has not tested for this issue but...
Imported Citrix Policy lists Delivery Group names from source site in the policy filter
If Citrix Policies are exported from a site and imported to a different site, the export caries Delivery Groups from source site in Assign Policy filter. Command to export & import policy Export-BrokerDesktopPolicy | Out-File -FilePath C:\Temp\PolicyExport.txt Import-BrokerDesktopPolicy Get-Conte...
