2725 matches found
CVE-2024-9671
A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed...
CTFd 安全漏洞
CTFd is a Capture The Flag framework open-sourced by CTFd. A security vulnerability exists in CTFd versions 2.0.0 through 3.7.2, which stems from a lack of privilege modification that allows an authenticated user to retrieve a list of users who have resolved a challenge, regardless of account...
PT-2024-30243 · Ctfd · Ctfd
Name of the Vulnerable Software and Affected Versions: CTFd versions 2.0.0 through 3.7.2 Description: The issue concerns a lack of access control in the ChallengeSolves endpoint /api/v1/challenges//solves that allows authenticated users to retrieve a list of users who have solved a challenge,...
CVE-2024-42988
Lack of access control in ChallengeSolves /api/v1/challenges//solves of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+...
CVE-2024-42988
Lack of access control in ChallengeSolves /api/v1/challenges//solves of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+...
CVE-2024-42988: Improper Access Control
Lack of access control in ChallengeSolves /api/v1/challenges/ /solves of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+...
CVE-2024-42988
The CTFd Capture The Flag framework (versions v2.0.0 through v3.7.2 ) is vulnerable to a lack of access control in the ChallengeSolves endpoint (/api/v1/challenges//solves). This flaw allows authenticated users to retrieve a list of users who have solved a specific challenge, bypassing the Accoun...
CVE-2024-42988
Lack of access control in ChallengeSolves /api/v1/challenges//solves of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+...
Cloud Logging Tip & Tricks: Getting the most value out of your cloud logs
In the cloud, logs are often the only way to get real-time visibility into what's happening, making them critical to any cloud detection and response program...
Improper Access Control
Overview Affected versions of this package are vulnerable to Improper Access Control via the abusefiltercheckmatch API, due to missing checks of the permissions to see the log details for the given filter. This allows an attacker to bypass hidden and protected visibility settings. Remediation A f...
CVE-2024-47762
A flaw was found in the backstage/plugin-app-backend package. Configurations supplied through APPCONFIG environment variables unexpectedly ignore the visibility defined in the configuration schema, potentially exposing sensitive configuration details intended to remain private or restricted to...
CVE-2024-47762 Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...
CVE-2024-47762 Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...
GHSA-QC4V-XQ2M-65WC Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Impact Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret...
PT-2024-32800 · Unknown · @Backstage/Plugin-App-Backend
Name of the Vulnerable Software and Affected Versions: @backstage/plugin-app-backend versions prior to 0.3.75 Description: The issue concerns the configuration supplied through APP CONFIG environment variables, where the visibility defined in the configuration schema is unexpectedly ignored. This...
CVE-2024-9391
A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. This bug only affects Firefox Focus for Android. Other versions of Firefox are...
Proactive Visibility Is Foundational to Strong Cybersecurity
Authored by Guest IDC Blogger: Michelle Abraham Exposures are more than CVEs, so organizations need to move beyond the traditional thinking of vulnerability management to a holistic view. Part of that view must be greater visibility into devices, users, applications, and all the digital...
unable to hide Published desktop for specific client device/domain groups via BrokerAccessPolicy
unable to hide Published desktop for specific client device/domain groups via BrokerAccessPolicy Limit visibility in a delivery group for specific user/client...
CVE-2024-6436
An input validation vulnerability exists in the Rockwell Automation Sequence Manager™ which could allow a malicious user to send malformed packets to the server and cause a denial-of-service condition. If exploited, the device would become unresponsive, and a manual restart will be required for...