Vultza

The software suffers from improper authorization checks, leading to potential unauthorized resource manipulation.

A denial of service condition exists due to inadequate input validation within the authentication logging process.

An improper access control issue can lead to the disclosure of sensitive information. The vulnerability affects Acronis Cyber Protect 17 on both Linux and Windows operating systems.

A sensitive information disclosure can occur due to an improper configuration of a headless browser.

The software suffers from insufficient access control validation, leading to unauthorized data access.

Insufficient access control allows unauthorized deletion of reports.

A local privilege escalation can occur due to improper handling of soft links. This allows an attacker with local access to potentially gain elevated privileges on the system.

A local privilege escalation can occur due to improper handling of soft links. This allows an attacker with local access to potentially gain elevated privileges on the system.

Insufficient authorization checks allow for unauthorized modification of settings. This impacts Acronis Cyber Protect 17 on both Linux and Windows operating systems.

An issue in Kibana Fleet allows for excessive resource allocation through a specially crafted bulk retrieval request. An attacker with low-level privileges, such as the viewer role providing read access to agent policies, can trigger redundant database retrieval operations. This process consumes memory rapidly, leading to a server crash and resulting in a denial of service for all users.

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) versions prior to build 40296 Description: The issue involves local privilege escalation due to improper soft link handling. Recommendations: Update Acronis Cyber Protect Cloud Agent to build 40296 or later.

The issue is related to a Server-Side Request Forgery (SSRF) vulnerability, which can lead to sensitive information disclosure.

The issue arises from the failure to validate the uniqueness and quantity of task actions within the "UpdateRunTaskActions" GraphQL operation. This allows an attacker to create task items that contain an excessive number of actions triggered by specific posts, leading to a denial-of-service (DoS) condition by overloading the server.

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.1 Mattermost versions 9.11.x through 9.11.9 Description: The issue allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation, as the software fails to check if a file has been deleted when creating a bookmark. Recommendations: For versions 10.5.x through 10.5.1, update to a version later than 10.5.1 to resolve the issue. For versions 9.11.x through 9.11.9, update to a version later than 9.11.9 to resolve the issue. As a temporary workaround, consider restricting access to bookmark creation functionality until a patch is available.

The issue is related to the lack of file size limitation for Slack import file uploads, which allows a user to cause a Denial of Service (DoS) via a zip bomb by importing data in a team they are an administrator of.

The issue is related to a failure in performing proper authorization checks in the "/api/v4/groups/<group-id>/channels/<channel-id>/link" endpoint. This allows a user to determine the members of an AD/LDAP group linked to a team by adding the group to a channel, even if the user has no access to the team.

The issue is related to the failure to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the "getSessions API" after flooding the sessions table.

The issue arises because Mattermost Server does not limit the number of user preferences, allowing an attacker to send a large number of user preferences, potentially causing denial of service.

The issue allows an authenticated attacker to crash the client applications of other users via large, crafted messages, due to the failure to limit the number of @-mentions processed per message.

The issue is related to a lack of proper authorization in requests fetching team-associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team they are not a member of. This can be exploited by a remote attacker to gain unauthorized access to user information. The vulnerable endpoint is related to the `/plugins/playbooks/api/v0/telemetry/run/` component.