GitLab 11.3 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13270)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API CVE-2020-13270 Note...

CVE-2023-47123

CVE-2023-47123 concerns iTop, an IT service management platform. The vulnerability arises when an attacker injects malicious code into an object’s friendlyname/complementary name, enabling an XSS attack when that object is rendered as an n:n relation item in another object. Affected behavior is l...

CVE-2024-32001

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or...

GHSA-J85Q-46HG-36P2 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

Background Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or folderparent. This bug only manifests if the same subject type is used multiple types i...

SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

Background Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or folderparent. This bug only manifests if the same subject type is used multiple types i...

CVE-2024-32001 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or...

CVE-2024-32001

Summary: CVE-2024-32001 affects SpiceDB. A bug in relations of the form folder: folder | folder#parent, when the same subject type is used multiple times and an arrow is used over the relation, can cause LookupSubjects to return only a subset of subjects. This affects any user making a negative a...

CVE-2024-32001 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or...

CVE-2024-23116 Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability

Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateLCARelation...

PT-2024-13409 · Itop +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 3.1.1 iTop versions prior to 3.2.0 Description: The issue allows an XSS attack to be performed when an object is displayed as an n:n relation item in another object, by filling malicious code in an object friendlyname o...

BIT-GITLAB-2020-13270

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...

PT-2024-13770 · Billing · Billing

Name of the Vulnerable Software and Affected Versions: Billing Software version 1.0 Description: The issue affects the material bill.php?action=itemRelation resource, where the itemnameid parameter does not validate the characters received, sending them unfiltered to the database. This leads to...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the AuthenticationService. A cached token persists after the lifetime of the request due to an improper implementation of relations between ITokens and IUsers. An attacker can cau...

CVE-2023-36375

Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details page...

PT-2023-25560

Name of the Vulnerable Software and Affected Versions Hostel Management System version 2.1 Description The issue allows an attacker to execute arbitrary code through a crafted payload to parameters such as Guardian name, Guardian relation, complimentary address, city, permanent address, and city ...

CVE-2022-23791

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting XSS.This issue affects Customer Relation Manager: before 2022.03.13...

CVE-2022-23790

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting XSS. This issue affects Customer Relation Manager: before 2022.03.13...

CVE-2022-23790

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting XSS.This issue affects Customer Relation Manager: before 2022.03.13...

CVE-2022-23790

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting XSS. This issue affects Customer Relation Manager: before 2022.03.13...

CVE-2022-23791

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting XSS. This issue affects Customer Relation Manager: before 2022.03.13...