CVE-2024-6322

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...

UBUNTU-CVE-2024-6322

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...

CVE-2024-6322

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...

CVE-2024-6322

CVE-2024-6322 is documented as a Grafana-related issue where access control for plugin data sources protected by the ReqActions field in plugin.json can be bypassed if a user or service account has query access to any other data source. The root cause is that the ReqActions check is not scoped to...

SUSE CVE-2024-22034

Attackers could put the special files in .osc into the actual package sources e.g. apiurl. This allows the attacker to change the configuration of osc for the victim...

PT-2024-37543 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Grafana versions 11.1.0 through 11.1.1 Grafana versions 11.1.2 through 11.1.3 Description: Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted...

PT-2024-19168 · Osc +2 · Osc +2

Name of the Vulnerable Software and Affected Versions: osc affected versions not specified Description: The issue allows attackers to manipulate the configuration of osc by injecting special files in .osc into the actual package sources, such as apiurl. This enables the attacker to alter the osc...

CVE-2024-7908

creationtimestamp| type| source ---|---|--- 2024-08-18 19:57:21+00:00| seen| https://t.me/cvedetector/3471 2024-08-18 20:24:49+00:00| seen| Telegram/wa5kCLBQ7DVrLjzwqVTDON-AGQYHb7Sn9Lq-G7-A9e52JtY...

CVE-2024-6459

creationtimestamp| type| source ---|---|--- 2024-08-17 08:56:59+00:00| seen| https://t.me/cvedetector/3378 2024-08-17 13:59:48+00:00| seen| https://t.me/CveExploits/8...

CVE-2024-22641

creationtimestamp| type| source ---|---|--- 2024-08-16 11:16:31+00:00| published-proof-of-concept| https://t.me/Rootsec2/3435 2024-11-19 17:49:20+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/10849...

CVE-2024-32136

creationtimestamp| type| source ---|---|--- 2024-08-16 11:16:31+00:00| published-proof-of-concept| https://t.me/Rootsec2/3435 2024-11-19 17:49:20+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/10849...

CVE-2024-40619

creationtimestamp| type| source ---|---|--- 2024-08-14 23:15:03+00:00| seen| https://t.me/cvedetector/3201 2025-02-01 17:28:09+00:00| seen| Telegram/10NuZ5LH3Ze-p9mdnRMwiIijzku0X52HrwXCpcodGdJ9A84a...

CVE-2024-5916

creationtimestamp| type| source ---|---|--- 2024-08-14 16:00:00+00:00| seen| https://security.paloaltonetworks.com/CVE-2024-5916 2024-08-14 19:54:01+00:00| seen| https://t.me/cvedetector/3175 2025-04-30 19:03:23+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3lo2id54bbl2y...

PT-2024-18706 · Dimension · Dimension

Name of the Vulnerable Software and Affected Versions: Dimension versions 3.4.11 and earlier Description: The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR...

CVE-2024-38193

creationtimestamp| type| source ---|---|--- 2024-08-13 18:05:01+00:00| seen| https://www.thezdi.com/blog/2024/8/13/the-august-2024-security-update-review 2024-08-13 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-08-13 21:18:33+00:00| seen| https://t.me/cvedetector/3065...

CVE-2024-38213

creationtimestamp| type| source ---|---|--- 2024-08-13 18:05:01+00:00| seen| https://www.thezdi.com/blog/2024/8/13/the-august-2024-security-update-review 2024-08-13 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-08-13 21:18:28+00:00| seen| https://t.me/cvedetector/3060...

CVE-2024-38178

creationtimestamp| type| source ---|---|--- 2024-08-13 18:05:01+00:00| seen| https://www.thezdi.com/blog/2024/8/13/the-august-2024-security-update-review 2024-08-13 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-08-13 21:18:40+00:00| seen| https://t.me/cvedetector/3072...

CVE-2024-42374

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering PDF creation unavailable. This affects...

PT-2024-29589 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 20.005.30636 through 24.002.20965 and earlier Description: The issue is a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requir...

CVE-2024-38271

creationtimestamp| type| source ---|---|--- 2024-08-12 12:44:11+00:00| seen| Telegram/NMamkVEHpjPy75q8OkNF-7ES7f0rvEvrOVZWOzTLall1cnfu 2024-08-14 12:47:24+00:00| published-proof-of-concept| https://t.me/truesecator/6087 2024-08-18 13:28:57+00:00| seen|...