CVE-2022-1677

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct...

CVE-2021-39394

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...

Error: User not authorized to execute this command when executing commands via CLI or GUI

Local User Receives:ERROR: Not authorized to execute this commandon CLI and in GUI. CLI GUI...

Security Bulletin: Vulnerability in HTTP request processing affects IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-8977)

Summary IBM License Metric Tool v9 and IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system. Vulnerability Details CVEID: CVE-2016-8977 DESCRIPTION: IBM BigFix...

CVE-2020-10728

A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. This container grants all users sudoer permissions allowing an unauthorized user with access to the running container the ability to escalate their own privileges. The highest threat from this vulnerabilit...

CVE-2020-10728

A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. This container grants all users sudoer permissions allowing an unauthorized user with access to the running container the ability to escalate their own privileges. The highest threat from this vulnerabilit...

Improper Authorization lead a user add an arbitrary agent into Team

Description A Vulnerability in edit team function lead an user add another user via ID to Team, alternatively know the email of every user in Chatwoot Step to reproduce - login to the app -navigate to the Team setting: https://app.chatwoot.com/app/accounts/id/settings/teams/list -Create new or ed...

MultiSafepay < 4.16.0 - Unauthenticated Arbitrary File Access

The plugin does not validate a parameter which could allow unauthenticated users to read arbitrary files on the web server...

GHSA-V3P8-J597-3XG8 Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.

Apache Hive before 3.1.3 CREATE and DROP function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users...

CVE-2021-34538

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...

Authorization

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...

CVE-2021-34538 Apache Hive Security vulnerability in Hive with UDFs

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged...

GitLab Remote Code Execution Vulnerability

GitLab is an open source, end-to-end software development platform from the U.S. company GitLab, with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. GitLab has a remote code execution vulnerability, the vulnerability...

CVE-2022-29271

In Nagios XI through 5.8.5, a read-only Nagios user due to an incorrect permission check is able to schedule downtime for any host/services. This allows an attacker to permanently disable all monitoring checks...

CVE-2022-29244

A flaw was found in npm. This security issue occurs because the npm pack ignores root-level ".gitignore" and ".npmignore" file exclusion directives when run in a workspace or with a workspace flag for example, --workspaces, --workspace=. Anyone who has run 'npm pack' or 'npm publish' inside a...

Information Disclosure

@finastra/nestjs-proxy is vulnerable to information disclosure. The vulnerability exists in the ProxyService function due to a lack of sanitization in the authorization header which allows an unauthorized user to access sensitive information in the system...

Security Bulletin: A vulnerability has been identified in IBM Elastic Storage System 3000 GUI where an unauthorised user can execute commands (CVE-2020-4348)

Summary A security vulnerability has been identified in IBM Elastic Storage System 3000 GUI that could allow an unauthorised user to execute commands . A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4348 DESCRIPTION: IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 an...

Magento Insufficient authorization check when adding users to company accounts

An insecure direct object reference IDOR vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing us...

Improper Access Control

publifycore is vulnerable to improper access control. The vulnerability exists in the update function in contentcontroller.rb due to improper validation of user permissions which allows an unauthorized user to modify the data in the system...

Privilege Escalation

github.com/cilium/cilium is vulnerable to privilege escalation. The vulnerability exists due to a lack of validation in container which allows an unauthorized user to access the Kubernetes account and make changes to the system...