CVE-2024-4142

CVE-2024-4142 describes an improper input validation vulnerability in JFrog Artifactory that can enable privilege escalation. Multiple connected sources confirm the issue arises from the token creation flow and allows users with low privileges to gain administrative access, potentially even when ...

PT-2024-29391 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.84.5 Description: An improper input validation issue could potentially lead to privilege escalation, allowing users with low privileges to gain administrative access to the system. This issue can also be...

CVE-2024-25709

There is a stored Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScrip...

CVE-2024-25709

There is a stored Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScrip...

Nautobot 安全漏洞

Nautobot is a web automation platform from the individual developers of Nautobot. A security vulnerability exists in Nautobot versions prior to 1.6.16, 2.1.9 and prior to 2.1.9, which stems from an unauthenticated anonymous user being unable to properly access multiple Nautobot URL endpoints...

PT-2024-22689

Name of the Vulnerable Software and Affected Versions Saleor Storefront versions prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 Description The issue affects Saleor Storefront, software for building e-commerce experiences. When any user authenticates in the storefront, anonymous users a...

Mirumee Software Saleor Storefront 安全漏洞

Mirumee Software Saleor Storefront is a web-based, single-page e-commerce application from Mirumee Software, Poland. A security vulnerability exists in Mirumee Software Saleor Storefront that stems from the fact that when any user authenticates in the storefront, an anonymous user can access its...

NamespaceHound: protecting multi-tenant K8s clusters

NamespaceHound is an open-source tool for detecting the risk of potential namespace crossing violations and anonymous access opportunities in multi-tenant clusters...

CVE-2024-0563

Denial of service condition in M-Files Server in versions before 24.2 excluding 23.2 SR7 and 23.8 SR5 allows anonymous user to cause denial of service against other anonymous users...

M-Files Server Security Vulnerability

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in versions of M-Files Server prior to 24.2 excluding versions 23.2 SR7 and 23.8 SR5, which stems from a vulnerability that allows an anonymous user to cause a denial of service to other anonymous...

PT-2024-15660

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 24.2 excluding 23.2 SR7 and 23.8 SR5 Description The issue allows an anonymous user to cause a denial of service against other anonymous users. Recommendations For versions prior to 24.2, update to version 24.2...

FreeBSD : gitea -- Prevent anonymous container access (bd7592a1-cbfd-11ee-a42a-5404a6f3ca32)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bd7592a1-cbfd-11ee-a42a-5404a6f3ca32 advisory. - Even with RequireSignInView enabled, anonymous users can use docker pull to fetch public images...

WordPress plugin Formidable Forms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability in the WordPress...

When anonymously accessed, the "Related Labels" section show labels that are tagged on pages in non-anonymous spaces.

h3. Issue Summary When anonymously accessed, the "Related Labels" section shows labels that are tagged on pages in non-anonymous spaces. This is reproducible on the Data Center: yes Pre-condition: 1. Page accessible anonymously has been labelled - e.g. label1 and label2. 2. Page that is not...

CVE-2023-22522

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution RCE on an affected instance. Publicly accessible Confluence Da...

CVE-2023-22522

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution RCE on an affected instance. Publicly accessible Confluence Da...

CVE-2023-22522

This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution RCE on an affected instance. Publicly accessible Confluence Da...

Vulnerability fixed in Atlassian Confluence

Atlassian has fixed a vulnerability in Confluence Data Center and Confluence Server. The vulnerability allows an authenticated malicious person able to execute arbitrary execute code with application privileges, potentially gain access to sensitive data. If access is configured as "anonymous...

CVE-2023-38584

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin commandwb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication...

CVE-2023-44391 Prevent unauthorized access to summary details in Discourse

Discourse is an open source platform for community discussion. User summaries are accessible for anonymous users even when hideuserprofilesfrompublic is enabled. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 version of Discourse. Users are advised to upgrade. There are no know...