Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-23628PUBLISHED: 2023-01-28
Metabase is an open source data analytics platform. Affected versions are subject to Exposure of Sensitive Information to an Unauthorized Actor. Sandboxed users shouldn't be able to view data about other Metabase users anywhere in the Metabase application. However, when a sandbox user views the sett...
CVE-2023-23629PUBLISHED: 2023-01-28
Metabase is an open source data analytics platform. Affected versions are subject to Improper Privilege Management. As intended, recipients of dashboards subscriptions can view the data as seen by the creator of that subscription. This allows someone with greater access to data to create a dashboard...
CVE-2023-23616PUBLISHED: 2023-01-28
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to...
CVE-2023-23617PUBLISHED: 2023-01-28OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.
CVE-2023-23620PUBLISHED: 2023-01-28
Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the `stable...
User Rank: Strategist
12/22/2014 | 9:42:46 AM
Maybe I'm misinterpretting the author's intent, but it doesn't just seem to be the author of this particular article. A great number of tech-news sites are covering this so-called issue this morning, and all of them are reporting essentially the same thing, that this is some sort of flaw. A misconfigured service is not a flaw, but rather a poorly thought-out security measure, and as is well known, there is no patch for human-stupidity. Either the sysadmin is competant or not. There is no half-way or grey-area where that is concerned. Either you know what you're doing or you don't, which *is* correctable provided the person on the receiving end of new training is competant enough to understand their training... otherwise, they're in the wrong line of work.