Path traversal

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it's...

CVE-2023-43645 Denial of service from circular relationship definitions in OpenFGA

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it's...

CVE-2023-43645 Denial of service from circular relationship definitions in OpenFGA

OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of service attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it's...

CVE-2023-43645

OpenFGA CVE-2023-43645 describes a DoS vulnerability triggered by Check calls against authorization models with circular relationships. The underlying issue is resources exhaustion when evaluating cyclic relations, potentially crashing the server. Remediation provided in multiple sources: upgrade...

Design/Logic Flaw

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

CVE-2023-37263 Strapi's field level permissions not being respected in relationship title

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

GHSA-M284-85MF-CGRC Strapi's field level permissions not being respected in relationship title

Summary Field level permissions not being respected in relationship title. If I have a relationship title and the relationship shows a field I don't have permission to see I will still be visible. Details No RBAC checks on on the relationship the relation endpoint returns PoC Setup Create a fresh...

Strapi's field level permissions not being respected in relationship title

Summary Field level permissions not being respected in relationship title. If I have a relationship title and the relationship shows a field I don't have permission to see I will still be visible. Details No RBAC checks on on the relationship the relation endpoint returns PoC Setup Create a fresh...

PT-2023-25867 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: Strapi versions prior to 4.12.1 Description: The issue concerns field level permissions not being respected in the relationship title. If an actor has a relationship title and the relationship shows a field they don't have permission to see,...

Zero Redemption Amount in RdpxDecayingBonds Contract

Lines of code Vulnerability details Impact The redeem function, as described, checks whether the assets to be redeemed assets are not zero. This check is in place to ensure that a user isn't redeeming a non-zero amount of rdpxAmount tokens in exchange for zero assets. Such a check is essential to...

SUSE: Security Advisory (SUSE-SU-2023:3358-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:3358-1 Security update for samba

This update for samba fixes the following issues: - CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend bsc1213174. Bugfixes: - Fixed trust relationship failure bsc1213384...

The vulnerability of the copy function for essential data provided by the supplier to business partners of the SAP Supplier Relationship Management application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the copy function for the supplier’s main data for application partners of SAP Supplier Relationship Management relates to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access...

CVE-2023-39436

SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to speciali...

CVE-2023-39436

SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to speciali...

CVE-2023-39436 Information Disclosure in SAP Supplier Relationship Management

SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be used to allow the attacker to speciali...

SAP Supplier Relationship Management 信息泄露漏洞

SAP Supplier Relationship Management SRM is a supplier relationship management solution from SAP. The product automates purchasing and acquisition processes within an organization and between suppliers, and provides functions such as invoicing. An information disclosure vulnerability exists in SA...

CVE-2023-36054

lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because xdrkadm5principalentrec does not validate the relationship between nkeydata and the keydata array...

samba security and bug fix update

4.17.5-103.0.1 - Fix memleak in nsswinbindinitgroupsdyn Orabug: 34994509 4.17.5-103 - resolves: rhbz2223600 - Fix trust relationship between workstation and DC - resolves: rhbz2222895 - Fix CVE-2023-3347...

samba security and bug fix update

4.17.5-3.0.1 - Fix memleak in nsswinbindinitgroupsdyn Orabug: 34727815 - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs in OL8 Orabug: 30205755 4.17.5-3 - resolves: rhbz2223601 - Fix trust relationship between workstation and DC - resolves: rhbz2222895 - Fix...