CVE-2023-30946 Issues notification metadata lacks authorization

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UU...

CVE-2023-30946

Foundry Issues had an authorization flaw where a user who could not view a resource could query Foundry’s Notification API and retrieve issue metadata (RID, severity, author UUID, and title). Affected are Foundry Issues prior to version 2.497.0; remediation is to upgrade to a fixed release (2.497...

CVE-2023-30955 Foundry workspace-server Developer Mode Authorization Bypass

A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Developer Mode settings in a limited capacity. A fi...

CVE-2023-30955 Foundry workspace-server Developer Mode Authorization Bypass

A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interact with Developer Mode settings in a limited capacity. A fi...

CVE-2023-30955

CVE-2023-30955 affects Palantir Foundry workspace-server prior to version 7.7.0, enabling a user to bypass an authorization check and view/interact with Developer Mode settings with insufficient privileges. The issue is resolved by upgrading to workspace-server 7.7.0 (fix deployed). Practical gui...

Palantir Foundry Issues 安全漏洞

Palantir Foundry Issues is an application from Palantir USA. A security vulnerability exists in Palantir Foundry Issues prior to version 2.497.0 that stems from allowing unauthorized users to retrieve issue metadata from Foundry's notification API...

USN-6166-1: libcap2 vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description David Gstir discovered that libcap2 incorrectly handled certain return codes. An attacker could possibly use this issue to cause libcap2 to consume memory, leading to a denial of service. CVE-2023-2602...

USN-6168-1: libx11 vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description Gregory James Duck discovered that libx11 incorrectly handled certain Request, Event, or Error IDs. If a user were tricked into connecting to a malicious X Server, a remote attacker could possibly use thi...

PT-2023-23084 · Foundry · Workspace-Server

Name of the Vulnerable Software and Affected Versions: Foundry workspace-server versions prior to 7.7.0 Description: A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This allowed users...

Palantir Foundry workspace-server 安全漏洞

Palantir Foundry workspace-server is a workspace service application from Palantir, Inc. A security vulnerability exists in Palantir Foundry workspace-server versions prior to 7.7.0 that originated from a vulnerability that allows an attacker to bypass authorization checks and view settings relat...

PT-2023-23077 · Unknown · Foundry Issues

Name of the Vulnerable Software and Affected Versions: Foundry Issues affected versions not specified Description: A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query...

USN-6165-1: GLib vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that GLib incorrectly handled non-normal GVariants. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or perform other unknown attacks. Update...

CVE-2023-20885

Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions...

CVE-2023-20885

Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions...

Design/Logic Flaw

Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions...

CVE-2023-20885 CF workflows leak credentials in system audit logs

Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions...

CVE-2023-20885

CVE-2023-20885 affects Cloud Foundry components: Notifications, SMB-volume, and cf-nfs-volume. The root issue is leakage of credentials through kernel audit logs, where arguments passed to binaries that access the filesystem can disclose admin/service credentials (e.g., cf auth --client-credentia...

CVE-2023-20885 CF workflows leak credentials in system audit logs

Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions...

PT-2023-17688 · Cloud Foundry · Cloud Foundry Nfs Volume +2

Name of the Vulnerable Software and Affected Versions: Cloud Foundry Notifications versions prior to 63 Cloud Foundry SMB-volume release versions prior to 3.1.19 Cloud Foundry cf-nfs-volume release versions prior to 5.0.27 Cloud Foundry cf-nfs-volume release versions prior to 7.1.19 Description:...

Cloud Foundry 日志信息泄露漏洞

Cloud Foundry is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from the U.S.-based Cloud Foundry Foundation. The product provides features such as container scheduling, continuous delivery, and automated service deployment. A security vulnerability exists in Cloud...