CVE-2024-36259

Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based yes/no response crafted attack...

CVE-2024-36259

Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensitive information via an oracle-based yes/no response crafted attack...

CVE-2024-36259

CVE-2024-36259 describes an improper access control in the mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 . The vulnerability allows remote authenticated attackers to extract sensitive information via an oracle-based (yes/no) crafted attack. The description is consistent across multi...

CVE-2024-12368

Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...

DEBIAN-CVE-2024-12368

Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...

CVE-2024-12368

Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...

CVE-2024-12368

Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...

CVE-2024-12368

Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...

CVE-2024-12368

CVE-2024-12368 describes an improper access-control flaw in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 that allows an internal user to export OAuth tokens belonging to other users. Multiple connected sources corroborate the same vulnerability scope and impact. The avail...

CVE-2024-12368

Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...

PT-2025-7903

Name of the Vulnerable Software and Affected Versions Odoo Community version 15.0 Odoo Enterprise version 15.0 Description The issue is related to improper access control in the auth oauth module, allowing an internal user to export the OAuth tokens of other users. Recommendations For Odoo...

CVE-2024-12368: Improper Access Control

Improper access control in the authoauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users...

Efficiency? Security? When the quest for one grants neither.

Welcome to this week's edition of the Threat Source newsletter. Benjamin Franklin once said, "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." In much the same way, those who rush for efficiency without taking into account...

BIT-DISCOURSE-2024-53266 Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse

Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in the user's profile page may be vulnerable to XSS. This has been patched in the latest version of Discourse core. Users are advised to...

BIT-DISCOURSE-2024-56197 Users can see other user's tagged PMs in Discourse

Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option is enabled, the other user is a member of a group added to this option, and the PM has been tagged. This issue has been patched in the late...

BIT-DISCOURSE-2025-22602 Stored DOM-based XSS (without CSP) via video placeholders in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder html element. This issue only affects sites with CSP disabled. This problem has been patched in the latest...

CVE-2024-5706

CVE-2024-5706 affects Hitachi Vantara Pentaho Data Integration & Analytics. Versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not restrict JNDI identifiers when creating Community Dashboards, allowing control of system-level data sources and potentially enabling access to or modification ...

CVE-2024-5706 Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. CWE-99 Hitachi Vantara Pentaho Data Integration & Analytics versions before...

CVE-2024-5706: Improper Control of Resource Identifiers

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. CWE-99 Hitachi Vantara Pentaho Data Integration & Analytics versions before...

CVE-2025-1369

creationtimestamp| type| source ---|---|--- 2025-02-17 01:58:12+00:00| seen| https://infosec.exchange/users/cve/statuses/114016746964992086 2025-02-17 02:15:58+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lidohhazjf23 2025-02-17 03:59:59+00:00| seen|...