PT-2024-3870 · Netapp · Ontap

Name of the Vulnerable Software and Affected Versions: ONTAP versions 9.4 and higher Description: The issue is related to the Object-Store Profiler Command Handler component in the Clustered Data ONTAP operating system for data storage systems. It involves the disclosure of sensitive information...

CVE-2023-31042

A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols...

CVE-2023-31042

A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols...

Design/Logic Flaw

A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols...

CVE-2023-31042 FlashBlade Object Store Protocol

A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols...

CVE-2023-28372 FlashBlade Object Store Privileged Access

A flaw exists in FlashBlade Purity OE Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock...

CVE-2023-28372 FlashBlade Object Store Privileged Access

A flaw exists in FlashBlade Purity OE Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock...

ROS-20230411-03

The Minio object store vulnerability is related to a user with console administrator privileges who could potentially create a user that matches the root access key, once this user is successfully created, root credentials will stop working properly. Exploitation of the of the vulnerability could...

ROS-20230317-03

A vulnerability in the Minio object store is related to improper enforcement of the bypass prohibition policy, with the removing a version identifier with the special header "X-Amz-Bypass-Governance-Retention: true". Exploitation of the vulnerability could allow an attacker acting remotely to gai...

Apache Ozone has unspecified vulnerabilities

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. a security vulnerability in Apache Ozone version 1.2.0, which stems from the fact that certain administrator-related SCM commands can be executed by any authenticated user...

Apache Ozone Licensing Issue Vulnerability (CNVD-2021-91629)

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments, an authorization issue vulnerability exists in Apache Ozone, which stems from the product's failure to protect OM requests with valid privileges. An attacker could create a...

Apache Ozone input validation error vulnerability

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments, an input validation error vulnerability exists in Apache Ozone, which stems from the product's Ozone Datanode not checking the block token's access mode parameter. An...

Apache Ozone has an unspecified vulnerability (CNVD-2021-91624)

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. Apache Ozone version 1.2.0 has a security vulnerability that allows an attacker to retrieve token data from the database and use it...

GitLab 日志信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

GHSA-PWHF-39XG-4RXW Script injection

Impact A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is...

Script injection

Impact A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is...

GHSA-GG96-F8WR-P89F Script injection

Impact A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limite...

Script injection

Impact A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limite...

CVE-2021-32660 TechDocs content sanitization bypass

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of @backstage/tehdocs-common prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These...

The vulnerability of the Object Store component in the Sun ZFS Storage Appliance Kit (AK) allows a hacker to gain full control over the application.

The vulnerability of the Object Store component in the Sun ZFS Storage Appliance Kit is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain full control over the application...