1423 matches found
CVE-2023-31066 Apache InLong: Insecure direct object references for inlong sources
Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Different users in InLong could delete, edit, stop, and start others' sources! Users are advised to upgrade to Apache InLong's...
CVE-2023-31066 Apache InLong: Insecure direct object references for inlong sources
Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Different users in InLong could delete, edit, stop, and start others' sources! Users are advised to upgrade to Apache InLong's...
CVE-2023-31098
CVE-2023-31098 concerns Apache InLong, affected in versions 1.1.0 through 1.6.0. The underlying issue is weak password requirements: the application does not enforce sufficient password complexity, enabling attackers to guess passwords and gain account access. The risk is described as a high impa...
CVE-2023-31101
CVE-2023-31101 affects Apache InLong 1.5.0–1.6.0 and allows users registered later to see data from deleted users due to insecure default initialization of resources. The vulnerability is categorized as an information disclosure issue; the publicly available fix is to upgrade to InLong 1.7.0 or c...
CVE-2023-31103 Apache InLong: Attackers can change the immutable name and type of cluster
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of cluster of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick...
CVE-2023-31103
CVE-2023-31103 describes an exposure of resource to wrong sphere vulnerability in Apache InLong, affecting versions 1.4.0–1.6.0. The issue allows attackers to change the immutable name and type of an InLong cluster, constituting an integrity risk. Remediation: upgrade to InLong 1.7.0 or cherry‑pi...
CVE-2023-31453
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised ...
Design/Logic Flaw
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong's 1.7.0...
CVE-2023-31206 Apache InLong: Attackers can change the immutable name and type of nodes
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick 1 to...
CVE-2023-31206
CVE-2023-31206 describes an Exposure of Resource to Wrong Sphere vulnerability affecting Apache InLong versions 1.4.0–1.6.0. The flaw allows an attacker to change the immutable name and type of InLong nodes due to exposure to the wrong sphere. Remediation across sources is to upgrade to InLong 1....
CVE-2023-31453
Apache InLong has a vulnerability CVE-2023-31453: incorrect permission assignment in versions 1.2.0–1.6.0 that allows deleting other users’ subscriptions. The issue is introduced in the access control for subscriptions and is not present in 1.7.0+. Remediation: upgrade to InLong 1.7.0 or cherry-p...
CVE-2023-31058
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or...
Deserialization of untrusted data
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or...
CVE-2023-31058 Apache InLong: JDBC URL bypassing by adding blanks
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or...
CVE-2023-31058 Apache InLong: JDBC URL bypassing by adding blanks
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attackers would bypass the 'autoDeserialize' option filtering by adding blanks. Users are advised to upgrade to Apache InLong's 1.7.0 or...
CVE-2023-31058
Summary (CVE-2023-31058): Deserialization of untrusted data in Apache InLong (1.4.0–1.6.0) allows attackers to bypass the autoDeserialize filtering by inserting blanks. This can enable unintended behavior as described; no exploitation details are provided here. Impact: high likelihood of bypass o...
GHSA-V9RM-7RV9-R3FW Apache OpenMeetings Improper Authentication vulnerability
An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0...
Apache OpenMeetings Improper Authentication vulnerability
An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0...
