CVE-2024-42174 HCL MyXalytics is affected by username enumeration vulnerability

HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames...

CVE-2024-42174

CVE-2024-42174 affects HCL DRYiCE MyXalytics (HCL MyXalytics). The vulnerability is a username enumeration issue that allows a malicious user to enumerate application users and compile a list of valid usernames. Public sources in the connected set confirm the affected product and the basic impact...

Soft Serve vulnerable to path traversal attacks

Impact Path traversal attack gives access to existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. Patches This is patched in v0.8...

CVE-2025-22130 Soft Serve allows path traversal attacks

Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without...

CVE-2025-22130 Soft Serve allows path traversal attacks

Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without...

Directory Traversal

Gogs is vulnerable to Directory Traversal. The vulnerability is due to improper input handling that allows a malicious user to write a file to an arbitrary path on the server, potentially gaining SSH access...

Gogs 安全漏洞

Gogs Go Git Service is a self-service Git hosting service based on the Go language by the Gogs team, which supports creating and migrating public/private repositories, adding and deleting repository collaborators, and so on. A security vulnerability exists in Gogs versions prior to 0.13.1, which...

Improper Authorization

github.com/cri-o/cri-o is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation during container restoration, allowing a malicious user to restore a pod without proper access to host mounts by exploiting the checkpoint restore process...

CVE-2024-8676

CVE-2024-8676 affects CRI-O; a checkpoint/restore sequence can cause mounts to be restored from the archive instead of the pod request, bypassing pod-mounted-access validations. This could let a remote attacker trick CRI-O/OpenShift into restoring a pod that lacks host mount access. Requirements:...

CVE-2024-8676 Cri-o: checkpoint restore can be triggered from different namespaces

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the...

CVE-2024-11670

The CVE-2024-11670 issue affects Devolutions Remote Desktop Manager (Windows) versions 2024.2.21 and earlier, due to incorrect authorization in the permission validation component that lets an authenticated user bypass the View Password permission. Documents from Red Hat, Tenable Nessus, CVE list...

Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares

None...

Open redirection when logging in with User OIDC

None...

CVE-2024-37285 Kibana arbitrary code execution via YAML deserialization

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges...

Argo Workflows Controller: Denial of Service via malicious daemon Workflows

Summary Due to a race condition in a global variable, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This was resolved by https://github.com/argoproj/argo-workflows/pull/13641 Details These two lines introduce a data race in the...

CVE-2024-10033

A vulnerability was found in aap-gateway. A Cross-site Scripting XSS vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions a...

SUSE CVE-2024-47515

A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw allows a malicious user to take advantage of the Pagure instance...

Google Golang 安全漏洞

Google Golang is a static strongly typed, compiled language from Google.Go's syntax is close to that of C, but differs with respect to variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages that...

Rocky Linux 8 : nano (RLSA-2024:6986)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:6986 advisory. nano: running chmod and chown on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file CVE-2024-5742...

FlashArray 安全漏洞

Pure Storage FlashArray is an all QLC flash storage array from Pure Storage, Inc. A security vulnerability exists in FlashArray that originates from a malicious user being able to use remote management services to create accounts on the array that allow privileged access...