10340 matches found
PT-2023-24861 · Percona · Percona Monitoring/Management
Name of the Vulnerable Software and Affected Versions: Percona Monitoring and Management PMM server versions 2.x through 2.37.0 Description: The issue arises from the authenticate function in auth server.go not properly formalizing and sanitizing URL paths, which fails to reject path traversal...
CVE-2023-34409
In Percona Monitoring and Management PMM server 2.x before 2.37.1, the authenticate function in authserver.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticat...
CVE-2023-34409
In Percona Monitoring and Management PMM server 2.x before 2.37.1, the authenticate function in authserver.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticat...
Percona Monitoring and Management 路径遍历漏洞
Percona Monitoring and Management is an open-source database monitoring solution from Percona, USA. A security vulnerability exists in Percona Monitoring and Management server version 2.x prior to 2.37.1, which stems from the authentication function in authserver.go that does not properly formali...
CVE-2023-34409
In Percona Monitoring and Management PMM server 2.x before 2.37.1, the authenticate function in authserver.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticat...
CVE-2023-34409
Summary: CVE-2023-34409 affects Percona Monitoring and Management (PMM) server 2.x up to 2.37.1. The vulnerability stems from the authenticate function in auth_server.go, which does not properly formalize or sanitize URL paths to reject path traversal. This allows an unauthenticated remote user t...
The Annual Report: 2024 Plans and Priorities for SaaS Security
Over 55% of security executives report that they have experienced a SaaS security incident in the past two years — ranging from data leaks and data breaches to SaaS ransomware and malicious apps as seen in figures 1 and 2. --- Figure 1. How many organizations have experienced a SaaS security...
The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to execute arbitrary code and increase their privileges.
The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code and increase their privileges...
The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to execute arbitrary code and increase their privileges.
The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute arbitrary code and increase their privileges...
The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to escalate their privileges.
The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges...
How Wazuh Improves IT Hygiene for Cyber Security Resilience
IT hygiene is a security best practice that ensures that digital assets in an organization's environment are secure and running properly. Good IT hygiene includes vulnerability management, security configuration assessments, maintaining asset and system inventories, and comprehensive visibility...
PT-2023-22374 · Unknown · Glitter Unicorn Wallpaper
Name of the Vulnerable Software and Affected Versions: Glitter Unicorn Wallpaper app versions 7.0 through 8.0 Description: The issue allows unauthorized apps to request permission to modify data in the database that records user personal preferences. This data is loaded into memory when the app i...
The vulnerability of the Power Monitoring Expert software allows a intruder to gain unauthorized access to protected information.
The vulnerability of the Power Monitoring Exper software-related system is related to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
CVE-2023-33187
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...
AZL-36943 CVE-2023-33187 affecting package highlight 4.18-1
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...
CVE-2023-33187
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...
Input validation
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...
CVE-2023-33187 highlight vulnerable to cleartext transmission of sensitive information
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...
CVE-2023-33187
CVE-2023-33187 affects Highlight (highlight.run) where passwords could be recorded when a password input is changed to type="text" via a Show Password control. The root cause is that switching input types could bypass obfuscation, allowing password values to be captured. The issue has been fixed ...
