Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2022-27892

Palantir Gotham included an endpoint that would log arbitrary sized payloads.

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory of the Gotham dispatch service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Gotham
CVE-2024-49587

Glutton V1 endpoints missing authentication

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automatically deployed to all Apollo-managed Gotham Instances

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Gotham
CVE-2022-27891

Palantir Gotham included an unauthenticated endpoint that listed all active usernames in the platform with an active session.

Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected services have been patched and automatically deployed to all Apollo-managed Gotham instances. It is highly recommended that customers upgrade all affected services to the latest version. This issue affects: Palantir Gotham versions prior to 103.30221005.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Gotham
CVE-2022-27897

Palantir Gotham included an endpoint that would log arbitrary sized zip files.

Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files to memory. An attacker could repeatedly upload a malicious zip file, which would allow them to exhaust memory resources on the dispatch server.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Gotham
CVE-2022-48306

Gotham Chat IRC help does not validate hostnames in TLS certificates

Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. This issue affects: Palantir Palantir Gotham Chat IRC helper versions prior to 30221005.210011.9242.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Gotham Chat Irc
CVE-2023-30962

Stored XSS in cerberus attachments

The Gotham Cerberus service was found to have a stored cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Gotham to launch attacks against other users. This vulnerability is resolved in Cerberus 100.230704.0-27-g031dd58 .

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Gotham Cerberus
CVE-2023-30961

Palantir Gotham UI bug that could lead to incorrect data classification

Palantir Gotham was found to be vulnerable to a bug where under certain circumstances, the frontend could have applied an incorrect classification to a newly created property or link.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Palantir
Products
Gotham-fe-bundle Titanium-browser-app-bundle