CVE-2024-30896

CVE-2024-30896 Riepilogo Un difetto nella logica di business di influxdb consente agli utenti che possiedono un token allAccess valido di escalare i propri privilegi a livello di operatore elencando i token di autorizzazione correnti. Scenario L'attaccante potrebbe essere un utente a cui un...

Privilege escalation via ApiTokensEndpoint

ImpactAn attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.There is no evidence that the issue was exploited on https://sentry.io. For...

Gitlab -- Vulnerabilities

Gitlab reports: Denial of Service issue in SAML Responses impacts GitLab CE/EE Server-Side Request Forgery issue in Webhook custom header impacts GitLab CE/EE Denial of Service issue in User-Controllable Fields impacts GitLab CE/EE Denial of Service issue in endpoint file upload impacts GitLab...

CVE-2021-25643

An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or...