CVE-2023-25559 System account impersonation in DataHub

DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service GMS will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieve...

CVE-2022-47132

A Cross-Site Request Forgery CSRF in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users...

CVE-2022-3482

An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only...

Improper access control

An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only...

CVE-2022-3482

An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only...

CVE-2022-3482

An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only...

CVE-2022-3482

An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only...

CVE-2022-46331

An unauthorized user could possibly delete any file on the system...

CVE-2022-46660

An unauthorized user could alter or write files with full control over the path and content of the file...

CVE-2022-43494

An unauthorized user could be able to read any file on the system, potentially exposing sensitive information...

CVE-2022-38469

An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords...

CVE-2022-38469

An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords...

Design/Logic Flaw

An unauthorized user could possibly delete any file on the system...

CVE-2022-38469

An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords...

CVE-2022-46331

An unauthorized user could possibly delete any file on the system...

CVE-2022-43494

GE Digital Proficy Historian is affected by a vulnerability (CVE-2022-43494) described as improper access control that could allow an unauthorized user to read any file on the system. The issue is tied to insufficient access controls in Proficy Historian v7.0 and newer, enabling potential exposur...

CVE-2022-46660

GE Digital Proficy Historian CVE-2022-46660 is a path/unsafe file write vulnerability affecting Proficy Historian (v7.0 and up per ICS advisory context). Connected sources describe exploitation via unrestricted upload of files and MSO protocol handling that allows an unauthorized user to alter or...

CVE-2022-46660

An unauthorized user could alter or write files with full control over the path and content of the file...

CVE-2022-42288

NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an information disclosure...

CVE-2023-22597

InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-319: Cleartext Transmission of Sensitive Information. They use an unsecured channel to communicate with the cloud platform by default. An...