CVE-2024-38871

Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module...

CVE-2024-38871 SQL Injection

Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module...

squid: vulnerable to a Denial of Service attack against Cache Manager error responses

A flaw was found in Squid, resulting in a potential denial of service attack targeting Cache Manager error responses. This issue enables a trusted client to execute a denial of service by manipulating the generation of error pages for Client Manager reports...

Privilege Escalation

org.opensearch.plugin:opensearch-reports-scheduler is vulnerable to Privilege Escalation. The vulnerability is due to improper checks on user authorization within the file UserAccessManager.kt when accessing resources in a private tenant, which allows an attacker to gain unauthorized access to...

The vulnerability of the Servlet component of the Oracle Reports Developer reporting software allows a malicious actor to gain access to read, modify, add, or delete data.

The vulnerability of the Servlet component in the Oracle Reports Developer reporting software is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, add, or delete access to data...

Authorization Bypass

silverstripe/reports is vulnerable to Authorization Bypass. The vulnerability is due to a flaw in the implementation of access control mechanisms within the ReportAdmin.php. It allows direct URL access to reports by any user who has access to the reports admin section, irrespective of whether the...

CVE-2024-29885

silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView method for that report returns false. This issue has been...

CVE-2024-29885

The CVE-2024-29885 entry concerns the silverstripe/reports API in the Silverstripe Framework, where reports could be accessed via direct URLs by any user with access to the reports admin section, even if canView() returns false. This is an Authorization Bypass affecting the Reports component; the...

CVE-2024-29885 Reports are still accessible even when `canView()` returns false in silverstripe/reports

silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView method for that report returns false. This issue has been...

CVE-2024-29885 Reports are still accessible even when `canView()` returns false in silverstripe/reports

silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView method for that report returns false. This issue has been...

jenkins-2-plugins: Improper input sanitization in HTML Publisher Plugin

A flaw was found in jenkins-2-plugins. In the HTML Publisher Plugin 1.16 through 1.32, fallback for reports created in HTML Publisher Plugin 1.15 and earlier does not properly sanitize input. This can allow attackers with Item/Configure permissions to implement stored cross-site scripting XSS...

CVE-2024-38870

Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module...

CVE-2024-38870 Stored XSS

Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module...

CVE-2024-38870

CVE-2024-38870 affects Zohocorp ManageEngine OpManager family. According to provided documents, a Stored XSS vulnerability exists in the reports module for: OpManager, OpManager Plus, OpManager MSP, and OpManager Enterprise Edition with affected version ranges: before 128104, from 128151 before 1...

GHSA-89Q6-98XX-4FFW Silverstripe Reports are still accessible even when `canView()` returns false

Reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView method for that report returns false. References - https://www.silverstripe.org/download/security-releases/cve-2024-29885...

Silverstripe Reports are still accessible even when `canView()` returns false

Reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView method for that report returns false. References - https://www.silverstripe.org/download/security-releases/cve-2024-29885...

CVE-2024-36387

creationtimestamp| type| source ---|---|--- 2024-07-17 12:43:59+00:00| seen| https://vulnerability.circl.lu/bundle/a23cbcad-e890-4df8-8736-9332ed4c3d47 2024-07-17 12:45:46+00:00| seen| https://vulnerability.circl.lu/bundle/c47579eb-e740-4902-8769-3c3df45be090...

CVE-2024-29885 - Reports are still accessible even when canView is set to false

More info at https://www.silverstripe.org/download/security-releases/cve-2024-29885...

PT-2024-23108 · Silverstripe · Silverstripe/Reports

Name of the Vulnerable Software and Affected Versions: silverstripe/reports versions prior to 5.2.3 Description: The issue allows reports to be accessed by their direct URL by any user who has access to view the reports admin section, even if the canView method for that report returns false...

CVE-2024-21133

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware component: Servlet. Supported versions that are affected are 12.2.1.4.0 and 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports...