PT-2023-18164 · Settings · Settings

Name of the Vulnerable Software and Affected Versions: Settings affected versions not specified Description: The issue is related to a missing permission check in Settings, allowing for a bypass of profile owner restrictions. This could lead to local escalation of privilege without requiring...

LACK OF INPUT VALIDATION ON THE _recipient ADDRESS IN THE RootBridgeAgent.retrySettlement FUNCTION CAN LEAD TO LOSS OF FUNDS TO THE USER

Lines of code Vulnerability details Impact The RootBridgeAgent.retrySettlement function is used to retry the settlement of tokens by the settlement owner. The retrySettlement function is an external payable function which does not have access control, hence can be called by any settlement owner b...

CLSA-2023-1696537563 Fix CVE(s): CVE-2023-39417

SECURITY UPDATE: SQL injection when @extowner@, @extschema@, or @extschema:...@ appeared inside a quoting construct dollar quoting, '', or "" - debian/patches/CVE-2023-39417: reject substituting extension schemas or owners matching "$'. - CVE-2023-39417 -- Pavel Kopylov Fri, 15 Sep 2023 10:55:03...

FreeBSD : Gitlab -- vulnerabilities (6e0ebb4a-5e75-11ee-a365-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6e0ebb4a-5e75-11ee-a365-001b217b3468 advisory. - An information disclosure issue in GitLab CE/EE affecting all versions prior to 16.2.8, 16.3...

PT-2023-5678 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 15.3 through 16.2.7 GitLab EE versions 16.3 through 16.3.4 GitLab EE versions 16.4 through 16.4.0 Description: An issue has been discovered in GitLab EE related to insufficient access control. The issue allows a remote...

CVE-2023-0829

Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner either a customer or an additional user, can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription...

PT-2023-16554 · Plesk · Plesk

Name of the Vulnerable Software and Affected Versions: Plesk versions 17.0 through 18.0.31 Description: A malicious subscription owner, either a customer or an additional user, can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription...

ipumirim.sc.gov.br Cross Site Scripting vulnerability OBB-3675732

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

inetprint.cz Cross Site Scripting vulnerability OBB-3662146

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Owner cannot rescueToken if blocklisted.

Lines of code Vulnerability details Impact Token could be stuck if owner is blocklisted by the token. Proof of Concept rescueToken can be used to rescue token sent to the contracts. function rescueTokensaddress token external onlyOwner uint256 balance = IRWALiketoken.balanceOfaddressthis;...

CVE-2023-3915

Removed by vendor...

GitLab Security Breach

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. GitLab suffers from a security vulnerability that stems from the fact that if ...

Lock owner DOS and funds stuck

Lines of code Vulnerability details Impact The lock's owner will no longer have the ability to use the delegate function. Meaning the person he chose to delegate can withdraw his funds when lock expires, but won't be able to. Proof of Concept Lets imagine 3 users with a Lock each: If user 1...

Undelegation logic doesn't work as expected, duo to that an owner of a lock would be enforced to extend their lock time for another 5 years.

Lines of code Vulnerability details Impact Undelegation logic doesn't work as expected, duo to that an owner of a lock would be enforced to reset his lock time for another 5 years through the function increaseAmount in order to successfully undelegate. Proof of Concept There are few differences...

Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation...

CVE-2023-4009

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation...

CVE-2023-4009

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation...

Privilege escalation

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation...

CVE-2023-4009 Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation...

CVE-2023-4009 Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation...