6024 matches found
CVE-2023-34049
The CVE-2023-34049 issue concerns Salt's Salt-SSH pre-flight: the pre-flight script is copied to a predictable path on the target. If an attacker can access the target VM and knows that path before execution, they can force Salt-SSH to run their script with the privileges of the Salt-SSH user. Th...
SUSE CVE-2024-9476
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizatio...
UBUNTU-CVE-2024-9476
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizatio...
CVE-2024-4741
CVE-2024-4741 affects OpenSSL when applications directly call SSL_free_buffers to free internal buffers for processing network records. The issue is a use-after-free: in two scenarios, the buffer is freed while still in use (during partial record processing or when only part of a record is read),...
CVE-2024-4741
Issue summary: Calling the OpenSSL API function SSLfreebuffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code...
Unauthorized Invite Deletion
github.com/grafana/grafana is vulnerable to unauthorized invite deletion. The vulnerability is due to insufficient access control validation in the system, where organization admins are not properly restricted to actions only within the organization they belong to. It allows admins to delete...
Microsoft Bookings Flaw Enables Account Hijacking and Impersonation
A vulnerability in Microsoft Bookings can expose your organization to serious security risks. Learn how attackers can exploit…...
CVE-2021-35473
CVE-2021-35473 affects LemonLDAP::NG prior to 2.0.12. The root cause is a missing expiration check in the OAuth2.0 handler, failing to verify access token validity, allowing use of expired tokens from an OIDC client to reach the OAuth2 endpoint. Earliest affected: 2.0.4. Impact is described as hi...
CVE-2021-41737
In Faust 2.23.1, a vulnerability is triggered by crafted input files containing lines such as "// r visualisation tCst" and "//process = +: L: abM-^Q;" followed by "process = route(3333333333333333333,2,1,2,3,1) : *;", which leads to stack consumption. The available sources consistently describe ...
CVE-2024-52009
Atlantis (a self-hosted Golang app that handles Terraform PR webhooks) exposes GitHub credentials in its logs when rotated. The root cause is that credentials (tokens like gh s_…) were written to logs, enabling someone with log access to impersonate Atlantis and perform GitHub actions, potentiall...
CVE-2024-10824
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token PAT a...
CVE-2024-10824
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed unauthorized internal users to access sensitive secret scanning alert data intended only for business owners. This issue could be exploited only by organization members with a personal access token PAT a...
CVE-2023-1973
CVE-2023-1973 is an Undertow vulnerability that allows a remote attacker to cause a Denial of Service by exploiting FormAuthenticationMechanism, leading to OutOfMemory on the server. The connected records (e.g., Red Hat RHSA-2025-9583) confirm this issue and indicate remediation via security upda...
CVE-2023-1932
CVE-2023-1932 involves a vulnerability in Hibernate Validator’s SafeHtmlValidator.isValid method. The flaw can be bypassed by omitting a tag ending in a less-than character, allowing browsers to render invalid HTML and potentially enabling HTML injection or Cross-Site Scripting (XSS). The entry s...
Tricks and Treats: Top 3 GenAI Security Best Practices for a Safer Halloween
Don’t get spooked: Navigate the risks of generative AI with proven strategies to protect your organization 👻...
BIT-GRAFANA-2024-10452
Organization admins can delete pending invites created in an organization they are not part of...
SUSE CVE-2024-10452
Organization admins can delete pending invites created in an organization they are not part of...
GHSA-66C4-2G2V-54QW Grafana org admin can delete pending invites in different org
Organization admins can delete pending invites created in an organization they are not part of...
