GHSA-5X9H-P2GX-35MG Incorrect Default Permissions in Liferay Portal

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page...

CVE-2022-42127

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page...

Code injection

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page...

CVE-2022-42127

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page...

CVE-2022-42127

CVE-2022-42127 affects Liferay Portal 7.4.3.5–7.4.3.36 and Liferay DXP 7.4 update 1–36, via the Friendly Url module. Root cause: insufficient permission checks allow remote attackers to obtain the history of all friendly URLs assigned to a page. Public exploit details are not provided in the docu...

CVE-2022-42127

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page...

[SECURITY] [DLA 3176-1] clickhouse security update

Debian LTS Advisory DLA-3176-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost November 03, 2022 https://wiki.debian.org/LTS Package : clickhouse Version : 18.16.1+ds-4+deb10u1 CVE ID : CVE-2021-42387 CVE-2021-42388 CVE-2021-43304 CVE-2021-43305 Debian Bug : 1008216...

CVE-2022-42197

In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify user permissions to higher privileges...

Improper access control

In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify user permissions to higher privileges...

CVE-2022-42197

In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify user permissions to higher privileges...

Server side request forgery (ssrf)

The integrated server of the ZGR TPS200 NG on its 2.00 firmware version and 1.01 hardware version, allows a remote attacker to perform actions with the permissions of a victim user. For this to happen, the victim user has to have an active session and triggers the malicious request...

PT-2022-17730 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Remisol Advance versions 2.0.12.1 and below Description: A vulnerability was discovered in the Remisol Advance for the Normand Message Server, where the permissions set by Remisol Advance allow non-privileged users to overwrite and/or...

The vulnerability of the Microsoft Visual Studio software, related to errors in processing input data, allows a hacker to execute arbitrary code.

The vulnerability of the Microsoft Visual Studio software relates to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code by running the malicious file with the user’s permission...

Information Disclosure

github.com/goharbor/harbor is vulnerable to information disclosure. The library fails to validate the user permissions to view Webhook policies including credentials configured in different projects, resulting in remote authenticated attackers being able to read Webhook policies of other...

Improper Authorization

github.com/goharbor/harbor is vulnerable to improper authorization. A remote authenticated attacker is able to gain access to unauthorized projects due to improper validation of the user permissions when updating tag immutability policies...

Harbor fails to validate the user permissions when updating a robot account

Impact Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. API call: PUT /robots/robotid By sending a request that attempts to update a robot account, and specifying a robot account id and robot...

GHSA-XX9W-464F-7H6F Harbor fails to validate the user permissions when updating a robot account

Impact Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. API call: PUT /robots/robotid By sending a request that attempts to update a robot account, and specifying a robot account id and robot...

Harbor fails to validate the user permissions when updating tag immutability policies

Impact Harbor fails to validate the user permissions when updating tag immutability policies - API call: PUT /projects/projectnameorid/immutabletagrules/immutableruleid By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated...

Harbor fails to validate the user permissions when viewing Webhook policies

Impact Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have access to, resulting in malicious users being able to read Webhook policies of other users/projects. API call is GET...

GHSA-JF8P-3VJH-PQ94 Harbor fails to validate the user permissions when viewing Webhook policies

Impact Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have access to, resulting in malicious users being able to read Webhook policies of other users/projects. API call is GET...