839 matches found
GHSA-R9MQ-3C9R-FMJQ Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
Description Path traversal This vulnerability allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as configuration files, environment variables, and other critical data stored on the...
CVE-2024-48914
Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...
CVE-2024-48914
Summary (CVE-2024-48914): Vendureâs asset server plugin allows an attacker to traverse the server filesystem and read arbitrary files, including configs and environment data, due to using the decoded request path directly in path.join (no normalization). A second vector in the same code path can ...
CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...
CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...
CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...
MinIO Bootstrap Verify Information Disclosure
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MinIO Bootstrap Verify Information Disclosure', 'Description' = %q MinIO is a Multi-Cloud Object Storage framework. In a cluster deployment...
GO-2022-0261 Authentication bypass issue in the Operator Console in github.com/minio/console
Authentication bypass issue in the Operator Console in github.com/minio/console...
The vulnerability of the MinIO object storage server, related to the exposure of confidential information to unauthorized individuals, allows attackers to disclose confidential information.
The vulnerability of the MinIO object storage server lies in the use of headers to determine whether an object exists on the server at a given time. Exploiting this vulnerability could allow a malicious actor to disclose confidential information...
ROS-20240807-05
A vulnerability in the PostPolicyBucket component of the MinIO object storage server is related to errors in privilege management. privilege management errors. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code by sending specially crafted HTTP...
GHSA-XR7Q-JX4M-X55M vulnerabilities
Vulnerabilities for packages: smarter-device-manager, melange, spire-server, step-ca, pulumi-language-dotnet, gomplate, ksops, grafana-agent-operator, vcluster, kubernetes-csi-external-provisioner, grafana-mimir, k8sgpt, ferretdb, kubernetes-csi-driver-hostpath, minio, kaniko, guac, terraform-doc...
GHSA-XR7Q-JX4M-X55M vulnerabilities
Vulnerabilities for packages: pulumi-language-dotnet, cloudnative-pg-fips, kargo, restic, osv-scanner, kaniko, spire-server, vault, zot, kube-rbac-proxy, restic-fips, rqlite, kots, vcluster, opentelemetry-collector-fips, hubble-ui-backend-fips, opa, conftest-fips, gomplate-fips, minio-fips, k3d,...
GO-2024-2499 Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio
Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalation in github.com/minio/minio...
GO-2024-2886 MinIO information disclosure vulnerability in github.com/minio/minio
MinIO information disclosure vulnerability in github.com/minio/minio...
BIT-MINIO-2024-36107 Information disclosure in minio
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. If-Modified-Since and If-Unmodified-Since headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a...
Sensitive Information Disclosure
github.com/minio/minio/ is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the ability to infer the existence of objects on a server by sending anonymous requests with random object names...
GHSA-95FR-CM4M-Q5P9 MinIO information disclosure vulnerability
Impact If-Modified-Since If-Unmodified-Since Headers when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information such as Last-Modified of the latest...
MinIO information disclosure vulnerability
Impact If-Modified-Since If-Unmodified-Since Headers when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information such as Last-Modified of the latest...