CVE-2024-58367

SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function argument...

The vulnerability of the cha_cmp component in the Virtuoso-opensource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the chacmp component in the Virtuoso-opensource web application development platform is related to the incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability may allow a malicious actor to cause a service failure after executing the...

PT-2024-40214 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.0.4 Description: The issue arises from the order in which permissions are processed, leading to potential leaks of field values or record contents to users without the required permissions. This can occur in...

The vulnerability of the box_add() function in the virtuoso-opensource web application development platform allows a hacker to trigger a service failure.

The vulnerability of the boxadd function in the virtuoso-opensource web application development platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures after executing the SELECT operator...

The vulnerability of the box_col_len() function in the virtuoso-opensource web application development platform allows a attacker to trigger a service failure.

The vulnerability of the boxcollen function in the virtuoso-opensource web application development platform is related to insufficient processing of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures after executing the SELECT operator...