8236 matches found
BIT-GITLAB-2022-0390
Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard...
BIT-MEDIAWIKI-2021-42047
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload such as alert via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback...
BIT-GRAFANA-2020-11110
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...
BIT-GRAFANA-2021-27962
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access...
BIT-APISIX_DASHBOARD-2021-33190 Bypass network access control
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...
BIT-APISIX_DASHBOARD-2021-45232 security vulnerability on unauthorized access.
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
PT-2024-22673
Name of the Vulnerable Software and Affected Versions ESPHome versions 2023.12.9 through 2024.2.x ESPHome version 2023.12.9 Description The dashboard component of ESPHome contains API endpoints that are vulnerable to Cross-Site Request Forgery CSRF, allowing remote attackers to carry out attacks...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: flannel, pulumi-language-dotnet, fulcio, vault-csi-provider, prometheus-mongodb-exporter, crossplane, minio, prometheus-alertmanager-fips, certificate-transparency, kube-logging-logging-operator, prometheus-beat-exporter, prometheus-node-exporter,...
CVE-2024-24785 vulnerabilities
Vulnerabilities for packages: ferretdb, s5cmd, thanos, fuse-overlayfs-snapshotter, cass-operator, cortex, kubernetes-csi-external-provisioner, pulumi-language-yaml, temporal-ui-server, dgraph, tflint, nodetaint, dask-gateway, trillian, up, pulumi-language-java, nri-mongodb, wait-for-port,...
Piwigo < 14.2.0 XSS Vulnerability
Piwigo is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; if...
GHSA-8P25-3Q46-8Q2P ESPHome vulnerable to remote code execution via arbitrary file write
Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...
ESPHome vulnerable to remote code execution via arbitrary file write
Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...
CVE-2024-27296 Directus version number disclosure
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known...
CVE-2024-27296
CVE-2024-27296 affects Directus: prior to 10.8.3, the exact Directus version is shipped in compiled JS bundles accessible without authentication, enabling attackers to map to known vulnerabilities in Directus core or dependencies. The issue has been fixed in 10.8.3 and later. Remediation is upgra...
CVE-2024-27295
Directus vulnerability CVE-2024-27295: the password reset flow can be abused due to accent-insensitive and case-insensitive comparisons in MySQL/MariaDB, enabling an attacker to request a reset for a victim’s account by using a near-identical email address (with accented characters). The issue af...
GHSA-9XXV-Q6PP-96WQ Concrete CMS Stored XSS
Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...
Concrete CMS Stored XSS
Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...
CVE-2023-49337
Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...
