PT-2024-15267

Name of the Vulnerable Software and Affected Versions ACF Quick Edit Fields for WordPress versions up to, and including, 3.2.2 Description The issue allows attackers without the edit users capability to access metadata of other users, including contributor-level users and above, due to Insecure...

VulnCheck KEV: CVE-2023-7286

The plugin ACF Quick Edit Fields for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.2.2. This makes it possible for attackers without the editusers capability to access metadata of other users, this includes contributor-level users and above...

CVE-2024-9539

An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to retrieve metadata information of a user who clicks on the URL and further exploit it to create a convincing phishing page. This required the attacker to uplo...

PT-2024-37736 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 Description: A broken access control issue exists in the saml.ts file, allowing a user from one organization to update the Identity Provider IDP settings and...

Lunary security vulnerabilities

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in Lunary that stems from improper controls in the saml.ts file, which can be exploited by an attacker to cause unauthorized access and potential account takeover, where a user of an...

GO-2022-1021 HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault

HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault...

PT-2024-40079 · Osv · Osv

Name of the Vulnerable Software and Affected Versions: OSV affected versions not specified Description: A security issue has been found where editors with access to the file meta data table can modify, create, or delete metadata of files outside their designated file mounts. Recommendations: At t...

Unspecified Vulnerability in Apache Superset (CNVD-2024-24409)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security vulnerability exists in Apache Superset versions prior to 3.1.2, which can be exploited by an authenticated attacker to access metadata from data sources they are not authorized to vie...

CVE-2024-28148 Apache Superset: Incorrect datasource authorization on explore REST API

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue...

CVE-2024-28148

Summary: Multiple sources describe an authorization issue in Apache Superset prior to 3.1.2. Affected product/component: Apache Superset, specifically the REST API used to explore datasources. Root cause (as stated): Incorrect datasource authorization on the explore REST API allowing an authentic...

CVE-2024-28148: Incorrect Authorization

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue...

Apache Ozone Improper Authentication vulnerability

Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozone Storage Container Manager service...

CVE-2023-6630

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7getcustomfield and CF7getcurrentuser shortcodes due to missing validation on a user controlled key. This makes it possible for...

CVE-2023-6630 Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7getcustomfield and CF7getcurrentuser shortcodes due to missing validation on a user controlled key. This makes it possible for...

PT-2023-21833 · Qualcomm · Qualcomm Chipsets

Name of the Vulnerable Software and Affected Versions: Qualcomm Chipsets affected versions not specified Description: The issue concerns information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE. Recommendations: At the moment, there is...

CVE-2023-47642

Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stream incorrectly continued being able to use the Zulip API to access metadata for that stream. As a result, users who had been removed from ...

PT-2023-30530

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 7.5 Description A security issue was found in Zulip, an open-source team collaboration tool, where users who had been removed from a stream could still access its metadata using the Zulip API. This included stream name,...

CVE-2023-21382

In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21663 Improper Restrictions of Operations within the Bounds of a Memory Buffer in Display

Memory Corruption while accessing metadata in Display...

PT-2023-25865 · Microsoft +3 · Azure +3

Name of the Vulnerable Software and Affected Versions: OpenComputers versions 1.2.0 through 1.8.3 Description: This issue affects OpenComputers with the Internet Card feature enabled, allowing players to gain access to sensitive information exposed via metadata services' API endpoints, such as...