BIT-GRAFANA-2021-39226 Snapshot authentication bypass in grafana

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "publicmode" configurati...

Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

cve-2017-7921-Mass-Exploit Mass Config Download python3 dow...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 1 (6.0.1-85)

This update provides stability and performance improvements. Vulnerability id: VSTOR-72592 Increased the speed of VM filtering in clusters with a huge number of existing projects. Vulnerability id: VSTOR-79462 Parts of a multipart object are not deleted. Vulnerability id: VSTOR-79650, VSTOR-80493...

PT-2024-9840

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.7.5 Description A vulnerability in the Linux kernel has been identified, which can cause a deadlock when using bcachefs with compression. The issue arises when snapshotting a mongodb data volume, resulting in a...

CVE-2023-41314

The api /api/snapshot and /api/getlogfile would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues...

Design/Logic Flaw

The api /api/snapshot and /api/getlogfile would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues...

CVE-2023-41314

CVE-2023-41314 affects Apache Doris; the vulnerability arises from unauthenticated access to /api/snapshot and /api/get_log_file, potentially enabling DoS and retrieval of arbitrary files from FE nodes. Worldwide references indicate affected product is Doris and advise upgrading to version 2.0.3 ...

PT-2023-27900 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.0.3 Description: The issue allows unauthenticated access through the API endpoints "/api/snapshot" and "/api/get log file". This could potentially lead to a DoS attack or allow an attacker to retrieve arbitrary...

Apache Doris 安全漏洞

Apache Doris is a modern MPP analytic database product of the U.S. Apache Apache Foundation. Can provide sub-second queries and efficient real-time data analysis. Apache Doris suffers from an authorization issue vulnerability that stems from api /api/snapshot and /api/getlogfile allowing...

Improper Handling of Insufficient Privileges (Leaky Vessels)

Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges Leaky Vessels via APIs for running interactive containers based on built images. It is possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, runnin...

Important: Red Hat Security Advisory: OpenShift Virtualization 4.14.1 security and bug fix update

Red Hat OpenShift Virtualization release 4.14.1 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

grafana: Spoofing of the originalUrl parameter of snapshots

A flaw was found in the grafana package. While creating a snapshot, an attacker may manipulate a hidden HTTP parameter to inject a malicious URL in the "Open original dashboard" button...

Snapshot fuzzing direct composition with WTF

Cisco Talos has developed a custom fuzzer using the popular snapshot fuzzer "WTF" which targets Direct Composition in Windows. Talos vulnerability research team used Protocol Buffers developed by Google to serialize and deserialize test cases. The Bochscpu backend of WTF was patched and other...

CVE-2023-27312

SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface...

CVE-2023-27312

SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface...

Code injection

SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface...

CVE-2023-27312 Privilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere

SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface...

CVE-2023-27312

NetApp SnapCenter Plugin for VMware vSphere is vulnerable in versions 4.6 through 4.8 (and 4.6–4.9 context) due to insufficient access control, allowing authenticated unprivileged users to modify email and snapshot name settings in the vSphere UI. Affected component: SnapCenter Plugin for VMware ...

NetApp SnapCenter Security Vulnerability

NetApp SnapCenter is a suite of applications from Network Appliance NetApp, Inc. that provides the ability to back up, verify, clone, and restore NetApp storage systems. A security vulnerability exists in NetApp SnapCenter version 4.6 VMware vSphere versions prior to 4.9 that originates from...

CVE-2023-36627

A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly...