CVE-2009-5002

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.1-P8AE-FP001 does not record Get Content Failure Audit events, which might allow remote attackers to attempt content access without detection...

CVE-2025-3932 Tracking Links in Attachments Bypassed Remote Content Blocking

It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web...

Security Vulnerabilities fixed in Thunderbird 128.10.1 — Mozilla

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an invalid value "Spoofed Name [email protected] [email protected]", Thunderbird treats [email protected] as the...

BIT-MOODLE-2024-34002 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include...

GHSA-CJ3W-G42V-WCJ6 ibexa/fieldtype-richtext allows access to external entities in XML

Impact This security advisory resolves a vulnerability in the RichText field type. By entering a maliciously crafted input into the RichText XML, an attacker could perform an attack using XML external entity XXE injection, which might be able to read files on the server. To exploit this...

CVE-2025-29868

Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of th...

Exploit for CVE-2025-29927

CVE-2025-29927-POC Introduction This repository contains...

D-Link DIR-823G 安全漏洞

The D-Link DIR-823G is a wireless router from China's AUO D-Link. The D-Link DIR-823G suffers from an authorization issue vulnerability that stems from improper authorization and can be exploited by an attacker to cause access control to sensitive content...

CVE-2025-27602

CVE-2025-27602 affects Umbraco CMS backoffice functionality. Authentication against the backoffice API could allow a user with Editor permissions to access or delete content and media in folders they should not reach, via manipulation of API URLs. The issue is described as a permissions/authentic...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the IsAuthorized function in ContentPermissionsQueryStringHandler.cs and MediaPermissionsQueryStringHandler.cs. A user with Editor permissions can retrieve or delete content and media of other users by passing...

GHSA-WX5H-WQFQ-V698 Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Impact Via manipulation of backoffice API URLs it's possible for authenticated backoffice users to retrieve or delete content or media held within folders the editor does not have access to. Patches Will be patched in 10.8.9 and 13.7.1 Workarounds None available...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco version 10.8.9 and prior to version 13.7.1, which stems from manipulation of backend API URLs that could result in the retrieval or deletion of content or media t...

Linux Distros Unpatched Vulnerability : CVE-2017-1000483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method...

Navigating the New Era of AI Traffic: How to Identify and Block AI Scrapers

In the not-so-distant past, webmasters faced challenges from bots like Google's search spiders, which diligently scanned websites to index content and provide the best search results for users. Fast forward to today, and we are witnessing a new breed of bot: Large Language Models LLMs like ChatGP...

CVE-2024-12447

The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-content' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

WordPress Members plugin <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Members versions = 3.2.10...

Security Bulletin: Daeja ViewONE may return unauthorised content

Summary An authenticated user of ViewONE may be able to access ViewONE cached content that they do not have repository authorisation to view. Vulnerability Details CVEID:CVE-2020-4720 DESCRIPTION: IBM Daeja ViewONE Professional, Standard & Virtual could allow an authenticated user to obtain...

CVE-2024-47766 Permissions are incorrectly verified for project administrators in the cross tracker search widget

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictio...

GHSA-39V3-F278-VJ3G @backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability

Impact When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. Patches This has been fixed in the 1.10.1...

DRUPAL-CONTRIB-2024-034

This module enables you to configure a wiki-like input filter that allows users to create links to site and external content. The module doesn't sufficiently check if a user has access to some URLs before rendering them as links. This vulnerability is mitigated by the fact that an attacker must...