JetBrains Hub Authentication Restriction Mechanism Bypass Vulnerability

JetBrains Hub is a server that can handle authentication, authorization, users, groups, permissions, and projects across multiple JetBrains Team Tools installations. An authentication restriction mechanism bypass vulnerability exists in JetBrains Hub versions prior to 2021.1.13690. An attacker ca...

FSDVesting: Restrict updateVestedTokens() calls to only FSD token contract

Handle hickuphh3 Vulnerability details Impact The updateVestedTokens increases the amount of tokens to be vested for a beneficiary. There is no access restriction to the function. The intended total vesting duration is 30 months with a 12-month cliff where 5% is immediately unlocked, and the...

NetApp Clustered Data ONTAP Vulnerabilities - Lenovo Support US

No description provided...

Restriction Bypass

chromium-browser:bionic is vulnerable to restriction bypass. Inappropriate implementation in iFrame Sandbox in Google Chrome allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

JetBrains Hub 授权问题漏洞

JetBrains Hub is a server that can handle authentication, authorization, users, groups, permissions, and projects across multiple JetBrains Team Tools installations. An authentication restriction mechanism bypass vulnerability exists in JetBrains Hub versions prior to 2021.1.13690. An attacker ca...

PT-2021-7326 · Mariadb +6 · Mariadb +7

Name of the Vulnerable Software and Affected Versions: MariaDB versions prior to 10.6.5 Description: The issue is related to an integer overflow in the sql lex.cc component of MariaDB, which can lead to an application crash. This can be exploited by an attacker to cause a denial of service...

CVE-2021-3924

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Grav 路径遍历漏洞

Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product presentations. A path traversal vulnerability exists in grav, which stems from an improper restriction of pathnames to restricted directories in the affected product...

CVE-2021-21698

An incorrect access restriction vulnerability was found in the Subversion Plugin for Jenkins. An agent's ability to learn the name of a file is not restricted when looking up a subversion key file on the controller. This may allow attackers to control agent processes and read arbitrary files on t...

CVE-2021-21698

Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent...

CVE-2021-21697

An incorrect access restriction vulnerability was found in Jenkins. The directories agents are allowed to access include the directories where there are stored build-related information intended to allow agents to store build-related metadata during build execution. As a consequence, this allows ...

CVE-2021-21688

An incorrect access restriction vulnerability was found in Jenkins. The FilePathreadingFileVisitor does not reject any operations giving users unrestricted read access with certain operations creating archives, copyRecursiveTo. This may allow an attacker to get access to restricted data. Mitigati...

CVE-2021-21698

CVE-2021-21698 affects Jenkins Subversion Plugin up to version 2.15.0. The issue arises because the plugin does not restrict the file name when resolving the subversion key file on the controller from an agent, enabling path traversal to read arbitrary files on the Jenkins controller when an atta...

CVE-2021-21698

Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent...

Huawei HarmonyOS restriction vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. Huawei HarmonyOS 2.0 previously had a security vulnerability that could be exploited by an attacker to cause nearby processes to crash...

PT-2021-23752 · Unknown · Sourcecodester Simple Subscription Website

Name of the Vulnerable Software and Affected Versions: Sourcecodester Simple Subscription Website version 1.0 Description: A Cross Site Scripting XSS issue exists due to the id parameter in plan application. This allows for potential malicious script execution. Recommendations: For version 1.0,...

Improper Authorization in Publify

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow. This happens due to front-end restriction only...

Access Restriction Bypass

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Access Restriction Bypass due to front-end restrictions. Random users can self-register even when the admin does not allow it. Remediation Upgrade...

CVE-2021-25973

Affected software: Publify (versions 9.0.0.pre1–9.2.4). Vulnerability type: Improper Access Control allowing a guest user to self-register even when the admin disallows it, resulting from front-end restriction rather than server-side controls. Impact (as described): Guest users can create account...

CVE-2021-25973 Publify - Improper Authorization Leads to Guest Signup Restriction Bypass

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only...