Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs through the manipulation of Twig templates. An attacker can modify or delete data by bypassing the sandbox restrictions designed to limit template capabilities. Note: This is only exploitable if the...

Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887...

GHSA-92QF-8GH3-GWCM Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887...

CVE-2024-53949 Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

Improper Authorization vulnerability in Apache Superset when FABADDSECURITYAPI is enabled disabled by default. Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue...

CVE-2024-53949

CVE-2024-53949 describes an improper authorization vulnerability in Apache Superset that occurs when the FAB_ADD_SECURITY_API is enabled (default is disabled). The issue allows lower-privilege users to use the security API to perform actions that should be restricted. Affected versions are 2.0.0 ...

CVE-2024-53948 Apache Superset: Error verbosity exposes metadata in analytics databases

Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue...

CVE-2024-53947 Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887...

CVE-2024-53947

CVE-2024-53947 : Apache Superset is affected by an SQL Injection vulnerability due to improper neutralization of certain engine-specific functions, allowing bypass of SQL authorization. The issue affects versions

CVE-2024-53947 Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887...

EUVD-2024-42181

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including...

ALPINE-CVE-2024-46901

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including...

CVE-2024-46901 Apache Subversion: mod_dav_svn denial-of-service via control characters in paths

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including...

PT-2024-9749

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.23.7 Description The issue is related to the getWindowsIEEE8021x function in the systeminformation library for node.js, where SSIDs are not sanitized before being passed as a parameter to cmd.exe. This...

[SECURITY] [DLA 3988-1] jinja2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3988-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk December 09, 2024 https://wiki.debian.org/LTS -...

CVE-2024-11234 affecting package php for versions less than 8.1.31-1

CVE-2024-11234 affecting package php for versions less than 8.1.31-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-8932 affecting package php for versions less than 8.1.31-1

CVE-2024-8932 affecting package php for versions less than 8.1.31-1. An upgraded version of the package is available that resolves this issue...

PT-2024-36555 · Unknown · Mailcleaner

Name of the Vulnerable Software and Affected Versions: MailCleaner versions before 28d913e Description: The issue concerns default values of ssh host dsa key, ssh host rsa key, and ssh host ed25519 key that persist after installation. Recommendations: For versions before 28d913e, update to a...

Credential Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Credential Exposure in the error message returned when the underlying database is down. An attacker who can cause the database server to be unreachable ...

CVE-2022-4968 affecting package netplan for versions less than 1.0.1-1

CVE-2022-4968 affecting package netplan for versions less than 1.0.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-40547 affecting package shim for versions less than 15.8-5

CVE-2023-40547 affecting package shim for versions less than 15.8-5. An upgraded version of the package is available that resolves this issue...