A flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permis…

▾ SunlitRed Hat · Red Hat Ceph Storage 7.1 ToolsEPSS 1.3%via CSAF

CVE-2023-39325High· 7.5PoC

3y ago

HTTP/2 rapid reset can cause excessive work in net/http

▾ Midnightstdlib · stdlibEPSS 3.8%via OSV

CVE-2023-20902Medium· 5.9

3y ago

Harbor timing attack risk

▾ Sunlitgoharbor · github.com/goharbor/harborEPSS 0.45%via OSV

Tagged “go”

Mattermost Injection vulnerability

Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability

lestrrat-go/jwx's malicious parameters in JWE can cause a DOS

Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass

Traefik vulnerable to potential DDoS via ACME HTTPChallenge

Traefik docker container using 100% CPU

ZITADEL Account Takeover via Malicious Host Header Injection

Mattermost Improper Access Control vulnerability

Mattermost Open Redirect vulnerability

Mattermost Uncontrolled Resource Consumption vulnerability

Decryption of malicious PBES2 JWE objects can consume unbounded system resources

Inefficient Regular Expression Complexity in git-urls

Attacker can cause Kyverno user to unintentionally consume insecure image

HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability

ZITADEL race condition in lockout policy execution

capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name

Calico Typha denial of service vulnerability

Kubernetes privilege escalation vulnerability

quic-go vulnerable to pointer dereference that can lead to panic

Kube-proxy may unintentionally forward traffic

Ingress-nginx path sanitization can be bypassed

Ingress nginx annotation injection causes arbitrary command execution

Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell

NATS.io: Adding accounts for just the system account adds auth bypass

Arduino Create Agent path traversal - local privilege escalation vulnerability

Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability

Cross-site Scripting via missing Binding syntax validation

grafana: incorrect assessment of permissions across organizations (CVE-2023-4822)

HTTP/2 rapid reset can cause excessive work in net/http

Harbor timing attack risk