Palantir 信任管理问题漏洞

Palantir is a data platform from Palantir, Inc. that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in versions prior to Palantir Gotham Chat IRC 30221005.210011.9242, which originates from a...

PT-2023-12923 · Palantir · Palantir Gotham

Name of the Vulnerable Software and Affected Versions: Palantir Gotham versions prior to 3.22.11.2 Description: The issue concerns an unauthenticated endpoint that loads portions of maliciously crafted zip files to memory. An attacker could exploit this by repeatedly uploading a malicious zip fil...

CVE-2022-27892 Palantir Gotham included an endpoint that would log arbitrary sized payloads.

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service...

CVE-2022-48306 Gotham Chat IRC help does not validate hostnames in TLS certificates

Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept...

Palantir 输入验证错误漏洞

Palantir is a data platform from US-based Palantir that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in Palantir Gotham versions prior to 3.22.11.2, which stems from the inclusion of an...

CVE-2022-27891 Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected servic...

CVE-2022-27891 Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected servic...

CVE-2022-48306

The CVE-2022-48306 vulnerability affects Palantir Gotham Chat IRC helper prior to version 30221005.210011.9242, due to improper validation of TLS hostnames. This hostname validation flaw enables a malicious actor with network access to perform a man-in-the-middle attack, potentially intercepting,...

Palantir 输入验证错误漏洞

Palantir is a data platform from Palantir, Inc. that reimagines how people use data by removing the barrier between back-end data management and front-end data analysis. A security vulnerability exists in Palantir Gotham versions prior to 3.22.11.2 that stems from the inclusion of an...

CVE-2022-27892

Palantir Gotham versions prior to 3.22.11.2 are affected by an unauthenticated endpoint that can exhaust the Gotham dispatch service memory. The issue is triggered by an endpoint that accepts unvalidated input to log or process arbitrary payloads, enabling memory exhaustion on the Gotham dispatch...

Palantir 信任管理问题漏洞

Palantir is a data platform from Palantir, Inc. that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in Palantir versions prior to 0.730.0, which stems from the Gotham Chat IRC Helper abusing the...

PT-2023-12922 · Palantir · Palantir Gotham

Name of the Vulnerable Software and Affected Versions: Palantir Gotham versions prior to 3.22.11.2 Description: The issue concerns an unauthenticated endpoint that could allow an attacker to exhaust the memory of the Gotham dispatch service. Recommendations: For versions prior to 3.22.11.2, updat...

CVE-2022-27891

Palantir Gotham CVE-2022-27891 describes an unauthenticated endpoint that surfaced all active usernames with sessions. Affected: Gotham versions prior to 103.30221005.0. Impact is primarily information disclosure; no exploitation/vector details are provided beyond the endpoint exposure. Remediati...

CVE-2022-27897

Palantir Gotham versions prior to 3.22.11.2 expose an unauthenticated endpoint that loads portions of maliciously crafted ZIP files into memory, enabling an attacker to repeatedly upload ZIPs and exhaust memory on the dispatch server. Affected software: Palantir Gotham before 3.22.11.2. Root caus...

[SECURITY] [DLA 1426-1] cups security update

Package : cups Version : 1.7.5-11+deb8u4 CVE ID : CVE-2018-4180 CVE-2018-4181 CVE-2018-6553 Several vulnerabilities were discovered in CUPS, the Common UNIX Printing System. These issues have been identified with the following CVE ids: CVE-2018-4180 Dan Bastone of Gotham Digital Science discovere...

gothamgazette.com XSS vulnerability

Vulnerable URL: http://www.gothamgazette.com/budgetgame/flashdetection.swf?flashContentURL=javascript:alert/XSSPOSED/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 507971 Google...

FreeBSD : mbedTLS/PolarSSL -- multiple vulnerabilities (5d280761-6bcf-11e5-9909-002590263bf5)

ARM Limited reports : Florian Weimar from Red Hat published on Lenstra's RSA-CRT attach for PKCS1 v1.5 signatures. These releases include countermeasures against that attack. Fabian Foerg of Gotham Digital Science found a possible client-side NULL pointer dereference, using the AFL Fuzzer. This...

Alienvault 4.3.1 - SQL Injection / Cross-Site Scripting

AlienVault 4.3.1 Unauthenticated SQL Injection Vulnerability Type: SQL Injection Reporter: Sasha Zivojinovic Company: Gotham Digital Science Affected Software: AlienVault 4.3.1 Severity: Critical =========================================================== Summary...

Microsoft Report Viewer Cross Site Scripting

================================================== Cross-Site Scripting XSS in Microsoft ReportViewer Controls Adam Bixby - Gotham Digital Science [email protected] Public Release Date: 8/9/2011 Confirmed Affected Software: Microsoft Report Viewer Redistributable 2005 SP1 and Microsoft Visual...

Adobe Flex 3.3 Cross Site Scripting

================================================== Adobe Flex 3.3 SDK DOM-Based XSS Public Release Date: 8/19/2009 Adam Bixby - Gotham Digital Science Affected Software: Adobe Flex 3.3 SDK and earlier ================================================== 1. Summary...