PT-2023-8896 · Grafana +2 · Grafana +2

Name of the Vulnerable Software and Affected Versions: Grafana affected versions not specified Description: The issue impacts Grafana instances with multiple organizations, allowing a user with Organization Admin permissions in one organization to change permissions associated with Organization...

Grafana 8.x < 9.4.17, 9.5.x < 9.5.13, 9.6.x < 10.0.9, 10.1.x < 10.1.5 Cross-Organization Permission Escalation Vulnerability

Grafana is prone to a cross-organization permission escalation by an organization administrator vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Microsoft Defender Thwarts Large-Scale Akira Ransomware Attack

Microsoft on Wednesday said that a user containment feature in Microsoft Defender for Endpoint helped thwart a "large-scale remote encryption attempt" made by Akira ransomware actors targeting an unknown industrial organization in early June 2023. The tech giant's threat intelligence team is...

HackerOne: Organization members can delete reports in teams they have no access to

Reports in teams could be deleted by organization members without access to those teams. The vulnerability allowed deletion of analytics reports for restricted teams through a GraphQL mutation even when members lacked permissions to view or edit those reports...

Grafana org admins can modify permissions across all orgs

Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor...

CVE-2023-45023

The CVE-2023-45023 entry corresponds to a Broken Access Control in the TYPO3 extension femanager. Multiple connected sources (GHSA-93J4-V838-8767, OSV, Veracode, and FriendsOfPHP advisory) describe that femanager fails to check access permissions for the invitation component, allowing remote atta...

CVE-2023-21386

CVE-2023-21386 is listed in Android 14 security release notes under the System category with Type “ID” and Moderate severity. The provided connected documents confirm the CVE entry exists, but do not provide the root cause, affected components beyond that category, or remediation details. No expl...

CVE-2023-24287

CVE-2023-24287 is a published buffer overrun issue reported across Ubuntu and Debian trackers related to the Undead puzzle. A crafted save file can cause a buffer overrun; the connected documents describe Ubuntu/Debian entries but do not provide explicit patch versions or remediation steps. Explo...

CVE-2023-24291

CVE-2023-24291 is a vulnerability affecting Simon Tatham’s Portable Puzzle Collection, described across multiple sources as a crafted save file causing a buffer overrun/overflow. Connected documents indicate this affects Linux/Ubuntu environments (e.g., an Ubuntu package). The exact affected vers...

CVE-2023-24288

CVE-2023-24288 affects Simon Tatham’s Portable Puzzle Collection. Multiple connected sources identify a vulnerability where a crafted save file can cause a buffer overrun/overflow in the puzzle collection software. Ubuntu/Debian advisories explicitly tie this CVE to the Portable Puzzle Collection...

CVE-2023-24285

CVE-2023-24285 involves a buffer overrun in the Netslide puzzle (sgt-puzzles) triggered by a crafted save file. Connected documents indicate Ubuntu/Debian advisories listing the Netslide puzzle as affected, with no details on patch availability or exact versions in the provided sources. Exploitat...

CVE-2023-24283

CVE-2023-24283 is a buffer overrun/overflow vulnerability described in multiple sources as affecting the Guess puzzle used by sgt-puzzles on Linux/Ubuntu. A crafted save file can trigger the overflow, leading to potential crash or code execution as implied by the notes on Ubuntu and related advis...

The vulnerability of the software for managing medical organizations like OpenEMR, related to lack of access control, allows a intruder to disrupt the logic of the application.

The vulnerability of the software for managing medical organizations like OpenEMR is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disrupt the logic of the application remotely...

SUSE-SU-2023:3738-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - CVE-2020-22218: Fixed a bug in libssh2packetadd which allows to access out of bounds memory. bsc1214527...

asia.uli.org Cross Site Scripting vulnerability OBB-3703793

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

huntingdon.pa.networkofcare.org Cross Site Scripting vulnerability OBB-3688231

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-21520

A PII Enumeration via Credential Recovery in the Self Service Credential Recovery of BlackBerry AtHoc version 7.15 could allow an attacker to potentially associate a list of contact details with an AtHoc IWS organization...

CVE-2023-21520

A PII Enumeration via Credential Recovery in the Self Service Credential Recovery of BlackBerry AtHoc version 7.15 could allow an attacker to potentially associate a list of contact details with an AtHoc IWS organization...

servicespace.org Cross Site Scripting vulnerability OBB-3676103

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Nation-State Actors Infiltrate U.S. by Exploiting Zoho and Fortinet Flaws

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Multiple nation-state entities infiltrated a prominent U.S. aeronautics organization by capitalizing on vulnerabilities within Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus,...