Salesforce OmniStudio 安全漏洞

Salesforce OmniStudio is a digitization platform from US-based Salesforce, Inc. A security vulnerability exists in Salesforce OmniStudio versions prior to 2025 that stems from an improper privilege retention issue that could lead to field-level security control bypass...

CVE-2023-23613

OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security FLS and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their...

PT-2025-22119 · Salesforce · Omnis Studio

Name of the Vulnerable Software and Affected Versions: Salesforce OmniStudio versions prior to Spring 2025 Description: The issue concerns the improper preservation of permissions in Salesforce OmniStudio FlexCards, allowing the bypass of field-level security controls for OmniUICard objects...

ROS-20250403-14

Vulnerability in the OpenSearch software package due to a problem in the implementation of Field Level Security FLS. Field Level Security FLS. Exploitation of the vulnerability could allow an attacker to obtain sensitive data Vulnerability in the OpenSearch software package due to missing spaces ...

Improper Access Control

Directus is vulnerable to Improper Access Control. The vulnerability is due to improper evaluation of field-level access permissions when multiple overlapping update policies apply, allowing users to update a superset of fields rather than only those permitted for a specific item...

GHSA-99VM-5V2H-H6R6 Directus allows updates to non-allowed fields due to overlapping policies

Summary If there are two overlapping policies for the update action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is allowed to update the superset of fields allowed by any of the policies. E.g. have one policy...

BIT-ELASTICSEARCH-2020-7019

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attack...

BIT-ELASTICSEARCH-2020-7020

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documen...

Kibana 8.0.x < 8.12.1 (ESA-2024-01)

The version of Kibana installed on the remote host is prior to 8.12.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2024-01 advisory. - An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document- level security DLS or Field-leve...

SUSE CVE-2024-23446

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security DLS or Field-level security FLS when querying the .alerts-security.alerts-spaceid indices. Users who are authorized to call this API may obtain unauthorized access to documents if...

CVE-2024-23446

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security DLS or Field-level security FLS when querying the .alerts-security.alerts-spaceid indices. Users who are authorized to call this API may obtain unauthorized access to documents if...

CVE-2024-23446

CVE-2024-23446 pertains to Kibana’s Detection Engine Search API failing to enforce Document-level security (DLS) and Field-level security (FLS) on .alerts-security.alerts-{space_id} indices. The issue allows users with API access and DLS/FLS-enabled roles to potentially read unauthorized document...

CVE-2024-23446 Kibana Broken Access Control issue

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security DLS or Field-level security FLS when querying the .alerts-security.alerts-spaceid indices. Users who are authorized to call this API may obtain unauthorized access to documents if...

CVE-2024-23446 Kibana Broken Access Control issue

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security DLS or Field-level security FLS when querying the .alerts-security.alerts-spaceid indices. Users who are authorized to call this API may obtain unauthorized access to documents if...

PT-2024-1691 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: The issue is related to insufficient access control in the Kibana data visualization service. It allows a remote attacker to impact the confidentiality of protected information. Specifically...

Improper Authorization

strapi-plugin-protected-populate is vulnerable to Improper Authorization. The vulnerability is due to the protectPopulate function of protect-route.js, which allows a users to populate fields they don't have access, resulting in field-level security bypass...

PT-2023-30736 · Strapi · Strapi Protected Populate Plugin

Name of the Vulnerable Software and Affected Versions: Strapi Protected Populate Plugin versions prior to 1.3.4 Description: The issue allows users to bypass field level security, enabling them to populate fields they do not have access to. This affects get endpoints, which are protected by the...

CVE-2023-37263 Strapi's field level permissions not being respected in relationship title

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

CVE-2023-37263

CVE-2023-37263 affects Strapi (open-source headless CMS). The issue: field-level permissions are not respected in the relationship title, causing a field the user should not see to be visible when a relation includes that field. Impact is described as information disclosure under older releases. ...

Improper Authorization

@strapi/plugin-content-manager is vulnerable to Improper Authorization. The vulnerability is due to Field level permissions not being respected in the relationship title, as there are no RBAC permission checks to read the field in relations.js...