Harbor fails to validate the user permissions when updating p2p preheat policies

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in oth...

CVE-2022-31668 User permission validation failure and disclosure of P2P preheat execution logs

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in oth...

CVE-2022-31670 Harbor fails to validate the user permissions when updating tag retention policies

Harbor fails to validate the user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag retention policies configured...

CVE-2022-31666 Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies

Harbor fails to validate user permissions while deleting Webhook policies, allowing malicious users to view, update and delete Webhook policies of other users. The attacker could modify Webhook policies configured in other projects...

Harbor 授权问题漏洞

Harbor is an open source registry from Harbor Open Source. Artifacts are protected through policies and role-based access control to ensure that images are scanned and are not vulnerable, and that images are signed as trusted. Harbor suffers from an authorization issue vulnerability that stems fr...

CVE-2024-50969

A Reflected cross-site scripting XSS vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbitrary web scripts or HTML via the search parameter...

CVE-2024-50969

A Reflected cross-site scripting XSS vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbitrary web scripts or HTML via the search parameter...

PT-2024-8870 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 17.3 through 17.3.7 GitLab EE versions 17.4 through 17.4.4 GitLab EE versions 17.5 through 17.5.2 GitLab CE versions 17.3 through 17.3.7 GitLab CE versions 17.4 through 17.4.4 GitLab CE versions 17.5 through 17.5.2...

CVE-2024-50969

CVE-2024-50969 affects Code-projects Jonnys Liquor 1.0 in browse.php, where a reflected XSS is possible via the search parameter. The vulnerability allows remote attackers to inject arbitrary scripts/HTML. Documents indicate this is a reflected XSS with user interaction required; no official patc...

CVE-2024-11127

A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploi...

CVE-2024-11127 code-projects Job Recruitment admin.php sql injection

A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploi...

CVE-2024-11127 code-projects Job Recruitment admin.php sql injection

A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploi...

CVE-2024-11100

A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely...

CVE-2024-11101

CVE-2024-11101 impacts the 1000 Projects Beauty Parlour Management System 1.0. The vulnerability exists in an unknown function of the file /admin/search-invoices.php , where manipulation of the searchdata parameter enables an SQL injection. The described impact is remote execution with the exploi...

CVE-2024-11099

A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the...

CVE-2024-11099 code-projects Job Recruitment login.php sql injection

A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the...

CVE-2024-11099 code-projects Job Recruitment login.php sql injection

A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the...

CVE-2024-11099

CVE-2024-11099 affects code-projects Job Recruitment 1.0, exploiting an SQL injection in the /login.php page via the email parameter. The vulnerability is reported as remote and has been disclosed publicly. Multiple connected documents confirm the issue and point to a code path involving user inp...

CVE-2024-11096 code-projects Task Manager newProject.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0. This affects an unknown part of the file /newProject.php. The manipulation of the argument projectName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2024-11096

CVE-2024-11096 affects code-projects Task Manager 1.0. The vulnerability is an SQL injection in the /newProject.php page, triggered by manipulating the projectName parameter. Exploitation is possible remotely, and public exploit information exists. The CVSS data across sources indicates various i...