153 matches found
CVE-2024-54002
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
CVE-2024-54002
Dependency-Track suffers a timing-based user enumeration flaw in /api/v1/user/login for usernames known to the system (LDAP/OpenID Connect users are unaffected). This CVE identifies that a longer response time reveals valid usernames, with the issue fixed in Dependency-Track 4.12.2. Affected prod...
CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
PT-2024-36009 · Unknown · Dependency-Track
Name of the Vulnerable Software and Affected Versions: Dependency-Track versions prior to 4.12.2 Description: The issue allows actors to enumerate valid names of managed users by leveraging the observable difference in request duration when performing a login request against the...
Dependency-Track 安全漏洞
Dependency-Track is Dependency-Track's open source set of intelligent supply chain component analysis platforms for identifying third-party component risks. A security vulnerability exists in Dependency-Track versions prior to 4.12.2 that stems from a significantly longer response time when...
CVE-2024-38374 vulnerabilities
Vulnerabilities for packages: hadoop-fips, dependency-track...
CVE-2024-38374 vulnerabilities
Vulnerabilities for packages: dependency-track...
GHSA-683X-4444-JXH8 vulnerabilities
Vulnerabilities for packages: hadoop-fips, dependency-track...
GHSA-683X-4444-JXH8 vulnerabilities
Vulnerabilities for packages: dependency-track...
GHSA-24RP-Q3W6-VC56 vulnerabilities
Vulnerabilities for packages: keycloak, mariadb, trino, dependency-track...
GHSA-24RP-Q3W6-VC56 vulnerabilities
Vulnerabilities for packages: keycloak, mariadb, trino, dependency-track...
GHSA-XFG6-62PX-CXC2 vulnerabilities
Vulnerabilities for packages: keycloak-fips, dependency-track, mariadb, keycloak, trino...
GHSA-XFG6-62PX-CXC2 vulnerabilities
Vulnerabilities for packages: trino, keycloak, dependency-track, mariadb...
CVE-2024-1597 vulnerabilities
Vulnerabilities for packages: keycloak, mariadb, trino, dependency-track...
CVE-2024-1597 vulnerabilities
Vulnerabilities for packages: keycloak, mariadb, trino, dependency-track...
GHSA-4265-CCF5-PHJ5 vulnerabilities
Vulnerabilities for packages: celeborn, opensearch, gradle, dependency-track, spdx-tools-java, druid, wavefront-proxy, tez, trino...