Harbor fails to validate the user permissions when updating tag retention policies

Impact Harbor fails to validate the user permissions when updating tag retention policies. API call: PUT /retentions/id By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modif...

GHSA-3637-V6VQ-XQQW Harbor fails to validate the user permissions when updating tag retention policies

Impact Harbor fails to validate the user permissions when updating tag retention policies. API call: PUT /retentions/id By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modif...

CVE-2022-39202

matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat IRC protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such...

CVE-2022-38135 WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin = 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings...

Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs

Impact Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs - API call GET /projects/projectname/preheat/policies/preheatpolicyname/executions/executionid/tasks/taskid/logs By sending a request that attempts to read P2P preheat...

GHSA-Q76Q-Q8HW-HMPW Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs

Impact Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs - API call GET /projects/projectname/preheat/policies/preheatpolicyname/executions/executionid/tasks/taskid/logs By sending a request that attempts to read P2P preheat...

Directus vulnerable to unhandled exception on illegal filename_disk value

The Directus process can be aborted by having an authorized user update the filenamedisk value to a folder and accessing that file through the /assets endpoint. The vulnerability is patched and released in v9.15.0. You can prevent this problem by making sure no untrusted non-admin users have...

CVE-2022-36031 Unhandled exception on illegal filename_disk value

Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the filenamedisk value to a folder and accessing that file through the /assets endpoint. This vulnerability has been patched and release v9.15....

Security Bulletin: IBM PureData System for Analytics vulnerable to unauthorized access and modification of local files (CVE 2013-5374)

Summary It is possible to read and modify local files via unknown vectors. Exploitation requires authentication and specific permissions. Confidentiality and integrity may be partially impacted and availability may be fully impacted. Vulnerability Details CVE ID:CVE-2013-5374 CVSS Base Score: 7.5...

CVE-2022-2568

A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser account and also remove the superuser privileges...

CVE-2022-2568

A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser account and also remove the superuser privileges...

PT-2022-17458 · Ansible · Ansible Automation Platform

Name of the Vulnerable Software and Affected Versions: Ansible Automation Platform affected versions not specified Description: A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with change user permissions to modify the account...

CVE-2022-2568

A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser account and also remove the superuser privileges...

Code injection

Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous user...

CVE-2022-2105 Secheron SEPCOS Control and Protection Relay

Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters...

CVE-2022-31050 Insufficient Session Expiration in TYPO3 Admin Tool

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This...

CVE-2022-32251

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an...

Authentication flaw

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an...

CVE-2022-32251

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an...

CVE-2022-32251

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an...