BIT-APISIX_DASHBOARD-2021-45232 security vulnerability on unauthorized access.

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...

PT-2024-22673

Name of the Vulnerable Software and Affected Versions ESPHome versions 2023.12.9 through 2024.2.x ESPHome version 2023.12.9 Description The dashboard component of ESPHome contains API endpoints that are vulnerable to Cross-Site Request Forgery CSRF, allowing remote attackers to carry out attacks...

CVE-2024-27287: Improper Neutralization of Input During Web Page Generation

ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation and Home Assistant add-on serves unsanitized...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: rabbitmq-cluster-operator, cri-tools, go-licenses, regclient, nri-couchbase, configmap-reload, hubble-ui, gcsfuse, shfmt, kustomize, task, ctop, paranoia, wireguard-go, kubernetes-csi-external-resizer, direnv, hey, secrets-store-csi-driver-provider-azure, go-md2man,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kube-logging-logging-operator, slsa-verifier, pulumi-language-java, kargo, nodetaint, crossplane-provider-family-aws, crossplane-provider-aws-dynamodb, mc-fips, spicedb, crossplane-provider-gcp, gomplate, kyverno-policy-reporter-ui, kubeflow-katib,...

Piwigo < 14.2.0 XSS Vulnerability

Piwigo is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; if...

CVE-2024-2133: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part of the file /dashboard/Cinvoice/manageinvoice of the component Manage Sale Page. The manipulation of the argument Title leads to cross si...

ESPHome vulnerable to remote code execution via arbitrary file write

Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...

GHSA-8P25-3Q46-8Q2P ESPHome vulnerable to remote code execution via arbitrary file write

Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...

CVE-2024-27296

CVE-2024-27296 affects Directus: prior to 10.8.3, the exact Directus version is shipped in compiled JS bundles accessible without authentication, enabling attackers to map to known vulnerabilities in Directus core or dependencies. The issue has been fixed in 10.8.3 and later. Remediation is upgra...

CVE-2024-27296 Directus version number disclosure

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known...

CVE-2024-27295

Directus vulnerability CVE-2024-27295: the password reset flow can be abused due to accent-insensitive and case-insensitive comparisons in MySQL/MariaDB, enabling an attacker to request a reset for a victim’s account by using a near-identical email address (with accented characters). The issue af...

Concrete CMS Stored XSS

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

GHSA-9XXV-Q6PP-96WQ Concrete CMS Stored XSS

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

CVE-2023-49337

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

CVE-2023-49337

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

Design/Logic Flaw

Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. 8.5 and earlier are unaffected...

Concrete CMS Security Vulnerability

PortlandLabs Concrete CMS is an open source team-oriented content management system from PortlandLabs, Inc. A security vulnerability exists in Concrete CMS prior to version 9.2.3, which stems from a stored cross-site scripting attack via /dashboard/system/basics/name...

CVE-2024-26016

CVE-2024-26016 affects Apache Superset. A low-privilege authenticated user can import a dashboard or chart they shouldn’t access and modify its metadata, effectively gaining ownership of the object. The vulnerability hinges on improper authorization validation during the import process; access to...

CVE-2024-26016

A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...