MongoDB Ops Manager Security Vulnerability

MongoDB Ops Manager is a solution from MongoDB, Inc. that supports the management, monitoring, and backup of MongoDB deployments. A security vulnerability exists in MongoDB Ops Manager versions prior to 5.0.22, 6.0.17, and 6.0.17, which originates from a user with Project Owner or Project User...

CVE-2023-4009: Incorrect Use of Privileged APIs

In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists due to improper role base access restrictions which allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request...

Privilege escalation in project role template binding (PRTB) and -promoted roles

Impact An issue was discovered in Rancher versions from 2.5.0 up to and including 2.5.16 and from 2.6.0 up to and including 2.6.9, where an authorization logic flaw allows privilege escalation via project role template binding PRTB and -promoted roles. This issue is not present in Rancher 2.7...

JBProjects.createFor should be able to set the project controller

Lines of code Vulnerability details Impact JBProjects.createFor doesn’t set the project controller. Project owners need to call JBDirectory.setControllerOf to set the project controller. However, an allowedlisted address can set the controller before the actual project owner. We can assume that...

Project Owner can mint all tokens to their own address

Lines of code Vulnerability details Impact A project owner may mint all tokens for the project in JBController.mintTokensOf , with all tokens minted by the project owner to their own address, the payer during any pay call would be unable to to mint any project token as the mint function would...

Improper access control

An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows a Merge Request creator to resolve discussions and apply suggestion...

Information disclosure

An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects...

CVE-2021-22215

An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects...

CVE-2021-22215

CVE-2021-22215 affects GitLab Enterprise Edition (GitLab EE) versions 13.11 and later. The issue is an information-disclosure vulnerability that allows a project owner to leak information about members’ on-call rotations in other projects. The Red Hat, OSV, Nessus, and other connected records cor...

CVE-2021-22215

Removed by vendor...

PT-2021-14916 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.11 and later Description: An information disclosure issue allows a project owner to leak information about the members' on-call rotations in other projects. Recommendations: For GitLab EE versions 13.11 and later, at the...

Privilege Escalation

github.com/rancher/rancher is vulnerable to privilege escalation. The vulnerability exists due to improperly enforced APIgroup rules, allowing a project owner with permissions to edit role bindings to allocate a cluster level role to grant themselves or others an admin role to that cluster...

CVE-2019-12303: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container...