32 matches found
CVE-2026-62420
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...
EUVD-2026-57411
An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...
CVE-2026-63300
An improper validation vulnerability in the instancePostMigration function in lxd/instancepost.go of LXD allows an authenticated attacker with cancreateinstances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fai...
CVE-2026-62420: Incorrect Authorization
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...
PT-2026-71224
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...
`opentelemetry_api` has been merged into the `opentelemetry` crate
Last release was on 2023-07-30. opentelemetryapi has been moved into the opentelemetry crate. Please use the opentelemetry crate going forward...
BIT-GITLAB-2020-10977
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects...
CVE-2022-41671
A CWE-89: Improper Neutralization of Special Elements used in SQL Command ‘SQL Injection’ vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected...
CVE-2022-41671
A CWE-89: Improper Neutralization of Special Elements used in SQL Command ‘SQL Injection’ vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected...
CVE-2022-41671: Improper Neutralization of Special Elements used in an SQL Command
A CWE-89: Improper Neutralization of Special Elements used in SQL Command ‘SQL Injection’ vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code. Affected...
PT-2022-6532 · Schneider Electric · Ecostruxure Operator Terminal Expert +1
Name of the Vulnerable Software and Affected Versions: EcoStruxure Operator Terminal Expert versions V3.3 Hotfix 1 or prior Pro-face BLUE versions V3.3 Hotfix 1 or prior Description: A SQL Injection vulnerability exists, allowing adversaries with local user privileges to craft a malicious SQL que...
The vulnerability of the library for simplifying project migration in Libbsd, related to reading beyond the permissible buffer data limits, allows attackers to gain access to confidential data and also trigger service failures.
The vulnerability of the library for simplifying project migration in Libbsd is related to reading data beyond the allowed buffer limits. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, as well as cause service failures...