603 matches found
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
A record user could learn the value of a hidden field by counting how many records match a guess. When DEFINE FIELD ... PERMISSIONS FOR select WHERE ... hides a field's contents from a caller, and that field is indexed, running SELECT count FROM t WHERE hiddenfield = "guess" GROUP ALL returned a...
5.9AI score
SaveExploits0References4Affected Software1
20