CVE-2024-37759

DataGear v5.0.0 and earlier was discovered to contain a SpEL Spring Expression Language expression injection vulnerability via the Data Viewing interface...

DataGear Security Breach

DataGear is an open source, free data visualization and analysis platform from DataGear, Inc. A security vulnerability exists in DataGear v5.0.0 and prior versions, which originates from the Data Viewing interface containing a SpEL expression injection...

CVE-2024-37759

DataGear v5.0.0 and earlier was discovered to contain a SpEL Spring Expression Language expression injection vulnerability via the Data Viewing interface...

CVE-2024-37759

DataGear v5.0.0 and earlier was discovered to contain a SpEL Spring Expression Language expression injection vulnerability via the Data Viewing interface...

CVE-2024-37759: Improper Neutralization of Special Elements in Output Used by a Downstream Component

DataGear v5.0.0 and earlier was discovered to contain a SpEL Spring Expression Language expression injection vulnerability via the Data Viewing interface...

CVE-2024-37759

DataGear version 5.0.0 and earlier are vulnerable to a SpEL (Spring Expression Language) expression injection within the Data Viewing interface (specifically the /data/{schemaId}/{tableName}/view endpoint). If a database table lacks a primary key, an attacker can inject malicious SpEL expressions...

PT-2024-27732 · Datagear · Datagear

Name of the Vulnerable Software and Affected Versions: DataGear versions 5.0.0 and earlier Description: A SpEL Spring Expression Language expression injection issue was found in the Data Viewing interface. This allows for potential malicious activity via the injection of expressions...

PT-2024-28454 · Mendelson · Mendelson As4

Name of the Vulnerable Software and Affected Versions: MENDELSON AS4 versions prior to 2024 B376 Description: The issue arises when a trading partner provides prepared XML data, exploiting a client-side vulnerability. This allows files to be written to the computer running the client process when...

PT-2024-27279

Name of the Vulnerable Software and Affected Versions ydata-profiling versions 3.7.0 or newer Description A cross-site scripting XSS issue in the ydata-profiling open-source library allows malicious payloads to run when a maliciously crafted report is viewed in the browser. Recommendations For...

CVE-2024-36118 Unauthorized viewing of workspace test cases in MeterSphere

MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other workspaces beyond their authority. This issue has been addressed in version 2.10.15-lts. Users of MeterSphere are advised to upgrade. There...

PT-2024-40086 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue concerns the reports CMS section, where it only checks the canView function when listing reports that can be viewed by the current user. However, it does not perform this chec...

CVE-2024-36241 /playbook add slash command allows viewing arbitrary post contents

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents via the /playbook add slash command...

GHSA-H6R4-XVW6-JC5H NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

Summary A stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. Details The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink. This function...

NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

Summary A stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. Details The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink. This function...

GHSA-WGX7-JP56-65MQ Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting

Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when: - resolving or closing issues bugchangestatuspage.php belonging to a project linking said custom field - viewing issues viewallbugpage.php when...

CVE-2024-33860

Logpoint versions prior to 7.4.0 are vulnerable to Local File Inclusion (LFI) . This issue occurs when an arbitrary File Path is used within the File System Collector , allowing an attacker to view the content of the specified file within the incoming logs. To resolve this, it is recommended to u...

CVE-2024-32467 Meteraphsere vulnerable to unauthorized viewing by workspace members

MeterSphere is an open source continuous testing platform. Prior to version 2.10.14-lts, members without space permissions can view member information from other workspaces beyond their authority. Version 2.10.14-lts fixes this issue...

The vulnerability of the Grafana monitoring and observation platform lies in its permission list for authorized access, which allows a violator to increase their privileges.

The vulnerability of the Grafana monitoring and observation platform relates to administrator permissions. Administrators have the ability to change the permissions associated with organizational viewing roles, organizational editors, and organizational administrators. Exploiting this vulnerabili...

The vulnerability in the virtual training environment Moodle, related to improper input neutralization during the creation of web pages, allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability in the virtual learning environment Moodle relates to the pre-viewing of course content that contains insecure data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2023-31634

In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the TeslaMate instance, an attacker can switch the port to 3000 to enter Grafana for remote operations. At that time, the default username and...