CVE-2024-12058

CVE-2024-12058 affects Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS). The issue arises from external control of a file name in the admin portal, allowing a remote authenticated attacker with admin privileges to read arbitrary files. Impact is limited to reading sensitive data from th...

The vulnerability of the Purchasing component in the Oracle PeopleSoft Enterprise SCM Purchasing application allows a hacker to gain read-only access to data or modify data.

The vulnerability of the Purchasing component in Oracle PeopleSoft Enterprise SCM Purchasing is related to incorrect authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain read access to data or modify data using HTTP requests...

Vulnerability of the Server component: Security: Privileges of the Oracle MySQL Server database management system, allowing attackers to gain read access to data, modify data, or obtain privileged access.

The vulnerability of the Server component, specifically the Security: Privileges section of the Oracle MySQL Server database management system, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to gain read access to data, modify...

graalvm: Unauthorized Read Access

A vulnerability was found in GraalVM and Mandrel Community Edition. Successful attacks of this vulnerability can result in unauthorized read access...

SUSE CVE-2025-23216

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

CVE-2022-2947

Altair HyperView Player versions 2021.1.0.27 and prior perform operations on a memory buffer but can read from or write to a memory location outside of the intended boundary of the buffer. This hits initially as a read access violation, leading to a memory corruption situation...

CVE-2024-1558

A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...

CVE-2024-28247

The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs...

mysql: Client: mysqldump unspecified vulnerability (CPU Apr 2024)

A flaw was found in the MySQL Server product of Oracle MySQL component: Client: mysqldump. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can resul...

BIT-MLFLOW-2024-1558 Path Traversal Vulnerability in mlflow/mlflow

A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...

GHSA-47G2-QMH2-749V Argo CD does not scrub secret values from patch errors

Impact A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally o...

CVE-2025-23216 Argo CD does not scrub secret values from patch errors

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

BIT-ELK-2024-43710 Kibana server-side request forgery

A server side request forgery vulnerability was identified in Kibana where the /api/fleet/healthcheck API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried...

CVE-2025-21567

A flaw was found in the MySQL Server component: Server: Security: Privileges. This vulnerability allows unauthorized read access to a subset of MySQL Server data via multiple protocols...

CVE-2024-43708

CVE-2024-43708 relates to Kibana: an unthrottled resource allocation can cause a crash when handling crafted requests to /api/metrics/snapshot and other UI inputs. Affected are Kibana 7.x prior to 7.17.23 or 8.x prior to 8.15.0 (per scan/OSV entries). The root cause is unbounded resource consumpt...

CVE-2024-43708

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana...

CVE-2024-43708

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana...

CVE-2024-52972

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana...

CVE-2024-43710

A server side request forgery vulnerability was identified in Kibana where the /api/fleet/healthcheck API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried...

CVE-2024-52972 Kibana allocation of resources without limits or throttling leads to crash

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana...