119 matches found
CVE-2026-25716
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...
CVE-2026-25784
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice container image bluespice/wiki allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service...
EUVD-2026-108653
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice container image bluespice/wiki allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service...
CVE-2026-25784
The BlueSpice software, specifically the bluespice/wiki container image, is vulnerable to privilege escalation due to an insecure default configuration in the token authenticator component (mwstake/mediawiki-component-token-authenticator ). The issue arises because the $mwsgTokenAuthenticatorServ...
CVE-2026-25784 bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice container image bluespice/wiki allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service...
EUVD-2026-108651
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...
CVE-2026-25716
Hallo Welt! GmbH BlueSpice is vulnerable to a Missing Authorization (CWE-862) flaw within the BlueSpiceUserManager extension. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete fail to verify the permissions of the acting user when calling UserManager::blockUse...
CVE-2026-25716 BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...
EUVD-2026-9393
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice Extension:NSFileRepo modules allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This...
CVE-2026-24732
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice Extension:NSFileRepo modules allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This...
CVE-2026-24732 Improper permission checks in Extension:NSFileRepo
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice Extension:NSFileRepo modules allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This...
CVE-2026-24732 Improper permission checks in Extension:NSFileRepo
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice Extension:NSFileRepo modules allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This...
CVE-2026-24732
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice Extension:NSFileRepo modules allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This...
CVE-2026-24732
CVE-2026-24732 affects Hallo Welt! GmbH BlueSpice Extension:NSFileRepo, with vulnerable versions 5.1–5.1.5 and 5.2–5.2.0. The issue is improper permission checks in the extension, allowing access to functionality not properly constrained by ACLs and bypassing electronic locks and access controls....
PT-2026-22907
Name of the Vulnerable Software and Affected Versions Hallo Welt! GmbH BlueSpice versions 5.1 through 5.1.5 Hallo Welt! GmbH BlueSpice versions 5.2 through 5.2.0 Description An issue exists in the Extension:NSFileRepo modules of BlueSpice that allows access to functionality not properly constrain...
Hello World! BlueSpice security vulnerability
Hello Welt! BlueSpice is a corporate knowledge base management software developed by the German company Hallo Welt!. There is a security vulnerability in BlueSpice, which stems from improper permission allocation for files and directories that are accessible from outside, as well as critical...
CVE-2026-24732: Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice Extension:NSFileRepo modules allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This...
EUVD-2022-43229
Malicious code in bioql PyPI...