6343 matches found
MINI-F5JQ-GG52-6GV4
Bulletin has no description...
MINI-H35F-J68G-XQR8
Bulletin has no description...
MINI-PCVJ-2P6M-W239
Bulletin has no description...
MINI-PWV8-C897-F29Q
Bulletin has no description...
MINI-M5HM-WX77-756V
Bulletin has no description...
ECHO-62AE-5071-E8C2
Bulletin has no description...
ECHO-AD5D-5AD5-1643
Bulletin has no description...
MINI-8X59-572V-RC64
Bulletin has no description...
MINI-WQ97-P985-PH24
Bulletin has no description...
GHSA-JXPM-75MH-9FP7 oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
Summary oras-go follows a registry-controlled Location header during the monolithic blob upload flow and reuses the Authorization header from the initial POST request for the subsequent PUT request. If a malicious registry returns a cross-host Location, oras-go can send the caller's credentials t...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the blobStore.completePushAfterInitialPost process. An attacker can obtain sensitive credentials by manipulating the Location header to redirect requests to an attacker-controlled endpoint, causing t...
oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
Summary oras-go follows a registry-controlled Location header during the monolithic blob upload flow and reuses the Authorization header from the initial POST request for the subsequent PUT request. If a malicious registry returns a cross-host Location, oras-go can send the caller's credentials t...
MINI-4JJJ-68X2-WC4W
Bulletin has no description...
MINI-9R9R-QCQ2-C222
Bulletin has no description...
MINI-CXJP-2544-QPH2
Bulletin has no description...
foreman: Foreman: Information disclosure via improper validation of nested request parameters
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...
foreman: Foreman: Information disclosure via improper validation of nested request parameters
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...
foreman: Foreman: Unauthorized modification of host configurations via broken access control
A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host. This is achieved by modifying the match field through nested host attributes, effectively bypassing...
ECHO-B8B6-B4BA-66A8
Bulletin has no description...
CVE-2026-5138
A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...