DA
Product
Data.all
5
CVEs
0
On KEV
6.3
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 5Low 0
Watch
Add Data.all to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-52311 | 6.3 | Nov 9 | Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests… Affected: 1.0.0 before 2.6.1 |
| CVE-2024-52312 | 5.4 | Nov 9 | Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and… Affected: 1.0.0 before 2.6.1 |
| CVE-2024-52314 | 4.9 | Nov 9 | A data.all admin team member who has access to the customer-owned AWS Account where data.all is deployed may be able to extract user data from data.all application logs in… Affected: 1.0.0 before 2.6.1 |
| CVE-2024-52313 | 4.3 | Nov 9 | An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not… Affected: 1.0.0 before 2.6.1 |
| CVE-2024-10953 | 4.3 | Nov 9 | An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member… Affected: 1.0.0 before 2.6.1 |
Showing 5