CVE-2023-53914

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative...

CVE-2023-53914

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative...

CVE-2023-53914

CVE-2023-53914 affects UliCMS 2023.1. An authentication bypass exists due to mass assignment in the UserController, enabling unauthenticated attackers to create admin users by sending a crafted POST to the admin/index.php endpoint with specific parameters, yielding full system access. Root cause:...

CVE-2023-53914 UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative...

CVE-2023-53914 UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative...

CVE-2023-53914: Authorization Bypass Through User-Controlled Key

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative...

UliCMS security vulnerabilities

UliCMS is a content management system CMS open source by UliCMS. The system supports features such as access control and WYSIWYG editing. A security vulnerability exists in UliCMS version 2023.1, which stems from an improper bulk assignment in UserController that could lead to authentication bypa...

PT-2025-51952

Name of the Vulnerable Software and Affected Versions UliCMS version 2023.1 Description An authentication bypass allows unauthenticated attackers to create administrative users. This is possible through mass assignment in the UserController by sending a crafted POST request to the ''index.php''...

FactoryTalk Linx Automation System Privilege Bypass

The vulnerability of the FactoryTalk Linx automation system’s software is related to the improper assignment of privileges. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the processing of ArgoCD Custom Resources. A namespace admin can gain elevated privileges and execute arbitrary workloads with root access on master nodes by crafting malicious custom resources after...

Linux driver Ethernet Faraday ftgmac100 Heap Buffer Overflow DoS

The vulnerability in the Ethernet/Faraday/FTGMac100.c driver of the Linux operating system is related to pointer assignment errors. Exploiting this vulnerability allows an attacker to cause a service failure...

net/mlx5 DoS

The vulnerability of the net/mlx5 component in the Linux operating system is related to pointer assignment errors. Exploiting this vulnerability allows an attacker to cause a service failure...

EUVD-2025-203232

The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it possible for unauthenticated attackers to create arbitrary...

com.cloudbees.jenkins.plugins:bees-sdk-plugin (>=1.0, <=1.2), com.cloudbees.jenkins.plugins:cloudbees-credentials (3.3) +48 more potentially affected by CVE-2025-67638 via org.jenkins-ci.main:jenkins-core (1.509)

org.jenkins-ci.main:jenkins-core MAVEN version 1.509 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudbees.jenkins.plugins:bees-sdk-plugin =1.0, =0.1.0, =0.1-beta-1, =0.10, =13.5.0, =13.5....

Linux TLS Protocol Heap Buffer Overflow DoS

The vulnerability of the tlsswspliceeof function in the net/tls/tlssw.c module of the Linux kernel’s TLS protocol implementation is related to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

F2FS Heap Buffer Overflow DoS

The vulnerability of the setextentinfo function in the fs/f2fs/extentcache.c module of the F2FS file system support in Linux’s operating system is related to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

AZL-71420 CVE-2025-40251 affecting package kernel for versions less than 6.6.119.3-1

In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devlratenodesdestroy The function devlratenodesdestroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific rateleafparentset or...

CVE-2025-40231 vsock: fix lock inversion in vsock_assign_transport()

In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsockassigntransport Syzbot reported a potential lock inversion deadlock between vsockregistermutex and sklock-AFVSOCK when vsocklinger is called. The issue was introduced by commit 687aa0c5581b "vsoc...

Insecure Direct Object Reference (IDOR)

com.liferay.portal, com.liferay.portal.impl is vulnerable to an Insecure Direct Object Reference IDOR. The vulnerability is due to improper access control on the comliferayusersadminwebportletUsersAdminPortletaddUserIds parameter, which allows an attacker to assign an organization to a user acros...

CVE-2025-55948: Incorrect Privilege Assignment

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control RBAC through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests...