CVE-2024-39701

Directus is a real-time API and App dashboard for managing SQL database content. Directus =9.23.0, =v10.5.3 improperly handles in, nin operators. It evaluates empty arrays as valid so expressions like "role": "in": $CURRENTUSER.somefield would evaluate to true allowing the request to pass. This...

CVE-2024-39895

Directus (graph-based API) is affected by a DoS via GraphQL field duplication. An attacker can craft a query to duplicate fields (e.g., GraphQL /graphql calls in dashboards), causing excessive resource usage and service unavailability. The vulnerability is fixed in Directus 10.12.0. Remediation: ...

CVE-2024-39895 Directus GraphQL Field Duplication Denial of Service (DoS)

Directus is a real-time API and App dashboard for managing SQL database content. A denial of service DoS attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single...

CVE-2024-39701

Directus (versions 9.23.0 through 10.5.3) improperly handles the _in and _nin operators by evaluating empty arrays as valid, causing Broken Access Control where a rule like {"role": {"_in": $CURRENT_USER.some_field}} may pass unexpectedly. The issue is fixed in Directus 10.6.0. Affected deploymen...

How to Install Grafana with K10 Dashboard and Data Sources Pre-provisioned

Purpose Starting in Veeam Kasten for Kubernetes v7.5.0, Grafana will no longer be included by default. This in-depth technical guide will demonstrate the process of installing Grafana on Kubernetes and populating it with Kasten Data. It will allow you to quickly access pre-provisioned Kasten...

Security Bulletin: IBM Datapower Operations Dashboard could allow unintended headers to MIME messages CVE-2024-21742

Summary Apache James Mime4J is used by the IBM Datapower Operations Dashboard stream parsing implementation. Vulnerability Details CVEID:CVE-2024-21742 DESCRIPTION: Apache James Mime4J could allow a remote attacker to bypass security restrictions, caused by improper input validation. By sending a...

Security Bulletin: IBM Datapower Operations Dashboard could allow a a denial of service CVEID 256137

Summary FasterXML Jackson Core is used by the IBM Datapower Operations Dashboard streaming and parsing implementation. Vulnerability Details IBM X-Force ID: 256137 DESCRIPTION: FasterXML Jackson Core is vulnerable to a denial of service, caused by improper input validation by the...

Malicious code in auth0-dashboard-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd3d9dcd233e8f88bec84813744dcf3ea68a677d4025fd66d55d2f1190be1b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7094 Malicious code in auth0-dashboard-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd3d9dcd233e8f88bec84813744dcf3ea68a677d4025fd66d55d2f1190be1b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Datapower Operations Dashboard could allow a denial of service condition CVE-2024-29025

Summary Netty is used by the IBM Datapower Operations Dashboard server implementation. Vulnerability Details CVEID:CVE-2024-29025 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw when using the HttpPostRequestDecoder to decode a form. By sending a specially crafted reques...

CVE-2024-36992

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthoriz...

CVE-2024-36992 Persistent Cross-site Scripting (XSS) in Dashboard Elements

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthoriz...

CVE-2024-36994 Persistent Cross-site Scripting (XSS) in Dashboard Elements

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View and Splunk Web Bulletin Messages that could...

Ray Dashboard Detection

Binary data raydashboardlocaldetect.nbin...

Splunk Enterprise 9.0.0 < 9.0.10, 9.1.0 < 9.1.5, 9.2.0 < 9.2.2 (SVD-2024-0712)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0712 advisory. - In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and...

CVE-2024-6354

Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard...

CVE-2024-6354

Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard...

CVE-2024-6354

Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard...

CVE-2024-6354

CVE-2024-6354 affects Devolutions Remote Desktop Manager (Windows) 2024.2.11 and earlier. The issue is an improper access control in the PAM dashboard that allows an authenticated user to bypass the execute permission via the PAM dashboard. The vulnerability is reported with a high impact (C/H, I...

CVE-2024-6354

Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard...