222 matches found
Casdoor - Authorization Bypass
Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. id: CVE-2025-4210 info: name: Casdoor - Authorization Bypass author: theamanrawat severity:...
GrafanaSCIMalform
Grafana SCIMalform CVE-2025-41115 ๆฆ่ฟฐ ๆฌไปๅบๆฏๆๅฏน Grafana Enterprise SCIM ็ปไปถไธญ CVE-2025-41115 ๆผๆด็็ ็ฉถใๅฎๅ ๅซไธไธชๅธฆๆๆผๆดๅบ็จๅๆผๆดๅฉ็จไปฃ็ ็ๆต่ฏ็ฏๅขใ ๅ่ ๅชๆฏไธไบๆ็จ็ๅ่๏ผ NIST - NIST ็ดขๅผ Grafana Article - ๅๅงๅๅฎขๆ็ซ Gitlab - GitLab ๅ ฌๅ Securityvulnerability.io - secirutvulnerability.io ไธ็ๆผๆด้กต้ข ๆ นๅ SCIM ้ข้ ็ฝฎไป ้็จไบ Grafana Enterprise ๅ Grafana...
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
SummaryOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the...
Blackash-CVE-2025-41115
๐ CVE-2025-41115: Escalada de privilegios crรญtica en SCIM de Grafana Vulnerabilidad crรญtica de escalada de privilegios en SCIM de Grafana Enterprise ๐ Resumen CVE-2025-41115 es una vulnerabilidad Crรญtica CVSS 10.0 en Grafana Enterprise que afecta a su funciรณn de aprovisionamiento de usuarios SCIM...
EUVD-2026-85327
scim-patch: Mutation of Inherited Built-in Method Objects...
NPM: scim-patch: Mutation of Inherited Built-in Method Objects
NPM: scim-patch: Mutation of Inherited Built-in Method Objects vulnerability discovered by ? in WordPress Npm scim-patch versions 0.9.2...
scim-patch: Mutation of Inherited Built-in Method Objects
Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...
GHSA-2MHW-WCX5-V3XJ scim-patch: Mutation of Inherited Built-in Method Objects
Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...
CVE-2026-61834
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...
CVE-2026-61834
The scim-patch library, used for applying SCIM patch operations, is vulnerable to process-global mutation in versions prior to 0.9.2 . The root cause lies in the navigate() function reading inherited properties and the assign() function using prototype-chain membership checks when resolving attac...
CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...
CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...
CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...
CVE-2026-61834: Improperly Controlled Modification of Dynamically-Determined Object Attributes
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...
PT-2026-97326
Name of the Vulnerable Software and Affected Versions scim-patch versions prior to 0.9.2 Description The library fails to properly validate SCIM PATCH paths, allowing the navigate function to read inherited properties and the assign function to use prototype-chain membership checks. An attacker c...
zitadel v4.18.0
The Identity Infrastructure for Developers ZITADEL...
BIT-GITLAB-2025-10903 Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the...
FreeBSD : Gitlab -- Vulnerabilities (161b1c49-a29b-11f1-a883-2cf05da270f3)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 161b1c49-a29b-11f1-a883-2cf05da270f3 advisory. Gitlab reports: Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude A...
CVE-2025-10903
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the...
CVE-2025-10903
GitLab EE is affected by an unbounded loop (infinite loop) in the SCIM user provisioning feature , allowing an authenticated user to trigger a denial of service via specially crafted input. The vulnerability affects all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1...