GHSA-487P-QX68-5VJW Hail relies on OIDC email claims to verify the validity of a user's domain.

Impact All Hail Batch clusters are affected. An attacker is able to: 1. Create one or more accounts with Hail Batch without corresponding real accounts in the organization. For example, a user could create a Microsoft or Google account and then change their email to "[email protected]"...

Hail relies on OIDC email claims to verify the validity of a user's domain.

Impact All Hail Batch clusters are affected. An attacker is able to: 1. Create one or more accounts with Hail Batch without corresponding real accounts in the organization. For example, a user could create a Microsoft or Google account and then change their email to "[email protected]"...

TikTok: Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products

The "Search Product" function in the TikTok Shop Seller API contained a vulnerability that allowed access to inactive or suspended products by manipulating the "live" parameter in the API request. The vulnerability was reported to the team and remediated...

GHSA-VF5M-XRHM-V999 Nautobot missing object-level permissions enforcement when running Job Buttons

Impact When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have permission to run Jobs in general?. Object-level permissions i.e., does the user have permission to run this specific Job? are not enforced by the URL/view used ...

CVE-2023-6802

An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a...

Design/Logic Flaw

An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a...

CVE-2023-6802

CVE-2023-6802 describes an information-in-logs vulnerability in GitHub Enterprise Server where sensitive data could be inserted into the audit log, potentially allowing access to the management console. Affected product: GitHub Enterprise Server (all versions since 3.8). Root cause: insertion of ...

CVE-2023-6802 Sensitive Information in Log File in GitHub Enterprise Server

An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a...

lack of slippage protection for increaseLiquidity, and decreaseLiquidity

Lines of code Vulnerability details Impact Lack of slippage protection for increasing and decreasing liquidity can cause the liquidity provider to provide liquidity at an unfavorable price. Or the borrower to borrow/repay in a manipulated pool. Proof of Concept When adding liquidity eventually...

GitHub Enterprise Server Security Vulnerability

GitHub Enterprise Server is a U.S. GitHub open source application. Provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions prior to 3.8.12, prior to...

Business Logic Vulnerability in dropTopVotedPiece Function

Lines of code Vulnerability details Potential Risk: The dropTopVotedPiece function in the CultureIndex contract allows the dropperAdmin to drop the top-voted piece. While the function checks if the caller is the dropperAdmin, there is a potential business logic vulnerability. The function only...

position can be opened without premium

Lines of code Vulnerability details Description Premium in ParticlePositionManager is used to cover trading fees accrued for the liquidity borrowed. When liquidating, a portion of the premium is also used for the liquidation reward. The issue is that a borrower can open a position without any...

Array is push()ed but not pop()ed, and is iterated over

Lines of code 96, 485, 485, 485, 485, 485, 485, 485, 485, 485, 485https://github.com/Tapioca-DAO/ta...

The vulnerability of the nagiosxi.xi_auditlog component in the Nagios XI monitoring tool allows a hacker to clear the audit log table.

The vulnerability of the nagiosxi.xiauditlog component of the Nagios XI monitoring tool is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to clear the audit log table remotely...

Unsafe use of approve() with IERC20

Lines of code 321, 215, 184, 450, 761, 217, 157, 234, 339, 386https://github.com/Tapioca-DAO/t...

CVE-2023-50918

app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs...

CVE-2023-50918

MISP prior to 2.4.182 is affected by a vulnerability in app/Controller/AuditLogsController.php where ACLs for audit logs are mishandled. The root cause is improper access control handling for audit logs, potentially enabling unauthorized access or disclosure of audit data. Remediation is to upgra...

PT-2023-31711 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.182 Description: The issue is related to the mishandling of ACLs for audit logs in the app/Controller/AuditLogsController.php file. Recommendations: For versions prior to 2.4.182, update to version 2.4.182 or later ...

CVE-2023-50918

app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs...

MISP Security Vulnerabilities

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.182, which stems from...