6007 matches found
CVE-2024-39925
An issue was discovered in Vaultwarden formerly BitwardenRS 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a...
PT-2024-37736 · Lunary · Lunary
Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 Description: A broken access control issue exists in the saml.ts file, allowing a user from one organization to update the Identity Provider IDP settings and...
Printable Staff ID Card Creator System 1.0 Insecure Direct Object Reference
============================================================================================================================================= | Title : printable staff id card creator system 1.0 idor Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...
CVE-2024-45323
An improper access control vulnerability CWE-284 in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissions in his profile and restricted to a specific organization to access backend logs that include...
CVE-2024-45323
An improper access control vulnerability CWE-284 in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissions in his profile and restricted to a specific organization to access backend logs that include...
CVE-2024-45323
An improper access control vulnerability CWE-284 in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissions in his profile and restricted to a specific organization to access backend logs that include...
CVE-2024-45323
An improper access control vulnerability CWE-284 in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissions in his profile and restricted to a specific organization to access backend logs that include...
CVE-2024-45323
CVE-2024-45323 affects FortiEDR Manager API versions 6.0 through 6.2.2. The root cause is improper access control (CWE-284) that, in a shared environment, allows an authenticated admin with REST API permissions (restricted to a single organization) to access backend logs containing information re...
PT-2024-9821 · Fortinet · Fortiedr Manager Api
Name of the Vulnerable Software and Affected Versions: FortiEDR Manager API versions 6.0 through 6.2.2 Description: The issue is related to improper access control, allowing an authenticated admin with REST API permissions, restricted to a specific organization, to access backend logs that includ...
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/hkario/marvin/, if PCKS 1 v1.5 padding is allowed when performing RSA descryption using a privat...
CVE-2023-39333
CVE-2023-39333 : Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may access data and functions that the WebAssembly module itself cannot access, effectively behaving like a JavaScript module. Affected software: Node.js on any active...
CVE-2023-39333
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...
CVE-2023-30584
CVE-2023-30584 affects Node.js 20 with the experimental permission model. It describes a path traversal bypass in how file permissions are verified due to improper handling within the experimental permission model. The vulnerability is described as local with high confidentiality and integrity im...
CVE-2023-30583
fs.openAsBlob can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob API. Please note that at the time this CVE was issued, the permission model is an...
Planned Parenthood partly offline after ransomware attack
In late August, Intermountain Planned Parenthood of Montana suffered a cyberattack which is still under investigation. The attack has been claimed by a ransomware group. Intermountain Planned Parenthood Inc., doing business as Planned Parenthood Of Montana, is a nonprofit organization that provid...
CVE-2024-5148
The CVE-2024-5148 issue affects the gnome-remote-desktop package. The gnome-remote-desktop system daemon inadequately validates session-handover via D-Bus during the login screen-to-user session transition, allowing a malicious local user to take control of the RDP client connection and potential...
CVE-2024-5148
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and...
MISP 安全漏洞
MISP is an open source software solution from MISP Open Source. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP version 2.4.196 and earlier...
