116 matches found
CVE-2022-35247
CVE-2022-35247 describes an information-disclosure in Rocket.Chat via the getRoomRoles Meteor method due to missing ACL checks. Affected: Rocket.Chat versions prior to 5, prior to 4.8.2, and prior to 4.7.5. The vulnerability allows an unauthorized client to leak channel members with special roles...
CVE-2022-35247
A information disclosure vulnerability exists in Rocket.chat v5, v4.8.2 and v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients...
CVE-2022-35247
A information disclosure vulnerability exists in Rocket.chat v5, v4.8.2 and v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients...
Increase balance for project without paying
Lines of code Vulnerability details Impact It seems that project owners can directly call recordAddedBalanceFor function at JBSingleTokenPaymentTerminalStore.solL696 to increase their project balance without paying anything Proof of Concept 1. Observe the recordAddedBalanceFor function 2. There i...
Rocket.Chat: getRoomRoles Method leaks Channel Owner
Summary Lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients. Description Lack of ACL checks in the getRoomRoles Meteor method allow unauthorized clients to query channel members with special roles: javascript Meteor.methods...
Joomla! 2.5.x < 3.9.28 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.28. It is, therefore, affected by multiple vulnerabilities. - Inadequate escaping in the Rules field of the JForm API leads to a Cross-Site Scripting XSS vulnerability...
Hardcoded credentials
An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in cominstaller lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for cominstaller is limited to super users already...
CVE-2021-26038
Joomla! 2.5.0 through 3.9.27 is affected by CVE-2021-26038 due to an install action in com_installer lacking hardcoded ACL checks for superusers, enabling privilege escalation. The default ACL for com_installer is limited to super users, so the default system is not affected. A patch is available...
Joomla 2.5.x < 3.9.28 Multiple Vulnerabilities (5840-joomla-3-9-28)
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.28. It is, therefore, affected by multiple vulnerabilities. - Inadequate escaping in the Rules field of the JForm API leads to a XSS vulnerability. CVE-2021-26035 - Missing...
[20210704] - Core - Privilege escalation through com_installer
Install action in cominstaller lack the required hardcoded ACL checks for superusers, leading to various potential attack vectors. A default system is not affected cause by default cominstaller is limited to super users already...
Joomla! 3.x < 3.9.25 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.9.25. It is, therefore, affected by multiple vulnerabilities. - Usage of the insecure rand function within the process of generating the 2FA secret. CVE-2021-23126 - Usage of an...
CVE-2021-26027
An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article...
Design/Logic Flaw
An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the category for an article...
CentOS 8 : cyrus-imapd (CESA-2020:4655)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4655 advisory. - cyrus-imapd: privilege escalation in HTTP request CVE-2019-18928 - cyrus-imapd: lmtpd component created mailboxes with administrator privileges if th...
Design/Logic Flaw
An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of commodules leak names of unpublished and/or inaccessible modules...
CVE-2021-23123
An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of commodules leak names of unpublished and/or inaccessible modules...
Privilege Escalation
cyrus-imapd is vulnerable to privilege escalation. It is possible in component created mailboxes with administrator privileges if the "fileinto" was used, bypassing ACL checks...
Moderate: cyrus-imapd security update
The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support. Security Fixes: cyrus-imapd: privilege escalation in HTTP request CVE-2019-18928 cyrus-imapd: lmtpd component created mailboxes with administrator privileges if the "fileinto" was used,...
