14 matches found
cluster-image-scanner
ClusterImageScanner Discover vulnerabilities and container image misconfiguration in production environments. Introduction The ClusterImageScanner detects images in a Kubernetes cluster and provides fast feedback based on various security tests. It is recommended to run the ClusterImageScanner in...
CVE-2026-16764
CVE-2026-16764 Privilege Escalation in OWASP DefectDojo via isstaff API bypass. Summary A user with only auth.changeuser permission can escalate to superuser in two steps: 1. Set isstaff=true on their own account via REST API validation only blocks issuperuser 2. Access Django Admin and check...
CVE-2026-16764
A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...
CVE-2026-16764: Improper Privilege Management
A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...
CVE-2026-3816
A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function inputzip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploi...
CVE-2026-3816: Improper Resource Shutdown or Release
A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function inputzip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploi...
PT-2026-24055
A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The explo...
CVE-2023-48171
An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component...
CVE-2023-48171
An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component...
CVE-2023-48171: Improper Privilege Management
An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component...
CVE-2023-48171
An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component...
CVE-2023-48171
CVE-2023-48171 affects OWASP DefectDojo before v1.5.3.1. The issue, described consistently across NVD/OSV/CVE feeds, is a privilege-escalation in the user permissions component that could allow a remote attacker to gain HIGH impact. The only remediation documented is to upgrade to DefectDojo v1.5...
