CVE-2024-10953

CVE-2024-10953 affects the data.all data platform (data-dot-all). An authenticated data.all user can perform mutating UPDATE operations on persisted Notification records for group notifications the user is not a member of, indicating an intra-tenant access control issue. The issue is observed acr...

CVE-2024-52312

CVE-2024-52312 affects data.all (open source framework). The issue stems from inconsistent authorization permissions that may allow an authenticated external actor to perform restricted operations on DataSets and Environments. Documents provide MEDIUM severity (CVSS 3.1/4.0) and describe the root...

CVE-2024-52313

CVE-2024-52313 affects data.all (Amazon data.all versions ≤ 2.6.0). The issue stems from incorrect authorization in the getDataset endpoint, allowing an authenticated data.all user to fetch information about a parent Environment resource that should require direct getEnvironment access. Impact is...