Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 213

Export CSV
CVE-2022-23773

golang: cmd/go: misinterpretation of branch names can lead to incorrect access control

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Beegfs Csi Driver Cloud Insights Telegraf Agent and 9 more
CVE-2022-22978

springframework: Authorization Bypass in RegexRequestMatcher

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

CVSS 3.1 · 9.8 Critical EPSS 12.4% KEV · Not listed
Vendors
Netapp Oracle Redhat and 1 more
Products
Active Iq Unified Manager Financial Services Crime And Compliance Management Studio Jboss Fuse and 2 more
CVE-2022-1466

keycloak: Improper authorization for master realm

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Keycloak Red Hat Single Sign On Single Sign-on
CVE-2022-1461

Non Privilege User can Enable or Disable Registered in openemr/openemr

Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2022-1177

Accounting User Can Download Patient Reports in openemr in openemr/openemr

Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2021-41571

Pulsar Admin API allows access to data from other tenants using getMessageById API

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Apache
Products
Pulsar
CVE-2021-39943

gitlab: An authorization logic error in the External Status Check API in GitLab EE

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2021-34401

kernel: NVIDIA driver improper access control may lead to code execution

NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execution, compromised integrity, or denial of service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Nvidia
Products
Android Shield Experience
CVE-2021-31384

Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service

Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any device interface regardless of the web-management configuration and filter rules which may otherwise protect access to J-Web. This issue affects: Juniper Networks Junos OS SRX Series 20.4 version 20.4R1 and later versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed
Vendors
Juniper
Products
Junos Srx1500 Srx300 and 7 more
CVE-2020-10731

openstack-tripleo-heat-templates: No sVirt protection for OSP16 VMs due to disabled SELinux

A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack Platform
CVE-2019-25058

usbguard: Fix unauthorized access via D-Bus

An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devices to be connected in the future.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 2 more
CVE-2019-0117

hw: Intel SGX information leak

Insufficient access control in protected memory subsystem for Intel(R) SGX for 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families; Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics may allow a privileged user to potentially enable information disclosure via local access.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel Redhat
Products
Core I5-7200u Core I5-7200u Firmware Core I5-7260u and 328 more
CVE-2024-6867

Information Disclosure in lunary-ai/lunary

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Lunary Lunary-ai
Products
Lunary Lunary-ai\/lunary