3425 matches found
PT-2023-31151 · Microsoft · Microsoft-Graph-Core
Name of the Vulnerable Software and Affected Versions: microsoft-graph-core versions prior to 2.0.2 Description: The Microsoft Graph Beta PHP SDK contains test code that enables the use of the phpInfo function from any application that can access and execute the file at...
CVE-2023-49103 - Critical Information Disclosure in ownCloud Graph API
Rapid7 is responding to CVE-2023-49103, an unauthenticated information disclosure vulnerability impacting ownCloud. Background ownCloud is a file sharing platform designed for enterprise environments. On November 21, 2023, ownCloud disclosed CVE-2023-49103, an unauthenticated information disclosu...
GitLab Security Breach
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. GitLab suffers from a security vulnerability that stems from the possibility...
Test code in published microsoft-graph package exposes phpinfo()
More info at https://nvd.nist.gov/vuln/detail/CVE-2023-49282...
Test code in published microsoft-graph-core package exposes phpinfo()
More info at https://nvd.nist.gov/vuln/detail/CVE-2023-49283...
VulnCheck KEV: CVE-2023-49103
ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo via GetPhpInfo.php, including administrative credentials...
ownCloud Information Disclosure Vulnerability (Nov 2023) - Active Check
ownCloud is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Owncloud Graph_Api
CVE-2023-49103 PoC for the CVE-2023-49103 Overview This Py...
PT-2023-9162 · Zabbix +4 · Zabbix +4
Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is caused by improper validation of the form input field Name on the Graph page in the Items section. This can lead to a cross-site scripting XSS attack, allowing a remote attacker...
CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...
PT-2023-30531 · Suitecrm · Suitecrm
Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 8.4.2 Description: The issue affects SuiteCRM, a Customer Relationship Management CRM software application, where Graphql Introspection is enabled without authentication. This exposes the scheme defining all object...
PT-2023-30763 · Librenms · Librenms
Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 23.11.0 Description: The issue allows a low-privilege user to enumerate devices on LibreNMS with their id or hostname by accessing a request sent to graph.php when they access their device dashboard. This enables th...
kernel: device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnodegraphgetnextendpoint The 'parent' returned by fwnodegraphgetportparent with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the paren...
GHSA-HM9R-7F84-25C9 Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes
Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to...
DRUPAL-CONTRIB-2023-050
This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's label creating an access bypass vulnerability. This vulnerability is mitigated by the fact that enti...
kernel: device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnodegraphgetnextendpoint The 'parent' returned by fwnodegraphgetportparent with refcount incremented when 'prev' is not NULL, it needs be put when finish using it. Because the paren...
Moderate: grafana security and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: persistent xss in grafana core plugins CVE-2022-23552 grafana: plugin signature bypass CVE-2022-31123 grafana: data source and plugin proxy endpoints leaking...
[SECURITY] Fedora 39 Update: cacti-1.2.25-1.fc39
Cacti is a complete frontend to RRDTool. It stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven...
OSV-2023-1071 Heap-use-after-free in igraph_pajek_yyparse
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63609 Crash type: Heap-use-after-free READ 11 Crash state: igraphpajekyyparse igraphreadgraphpajek readpajek.cpp...
