237 matches found
PT-2025-39627
Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.6 through 18.2.6 GitLab EE versions 18.3 through 18.3.2 GitLab EE versions 18.4 through 18.4.0 Description A privilege escalation issue exists in GitLab EE. A developer possessing specific group management permissions may...
PT-2025-37551
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free vulnerability exists in the Linux kernel's Btrfs file system related to block group management. Specifically, if a task creates a new block group that becomes unused...
kernel: ipv6: mcast: extend RCU protection in igmp6_send()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6send igmp6send can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use...
Astra Linux โ Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerabilities have been resolved: ipv6: mcast: Extended RCU protection in igmp6send igmp6send can be called without RTNL or RCU being held. We have extended RCU protection so that we can safely retrieve the net pointer and avoid a potential UAF...
CVE-2025-4433
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges...
CVE-2025-4433
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges...
CVE-2025-4433
CVE-2025-4433 affects Devolutions Server (versions 2025.1.7.0 and earlier). The vulnerability arises from improper access control in User Group Management, enabling a non-administrative user who has both User Management and User Group Management permissions to escalate privileges by adding users ...
Devolutions Server ่ฎฟ้ฎๆงๅถ้่ฏฏๆผๆด
Devolutions Server is an application from Devolutions Canada Inc. which provides a full-featured shared account and password management solution. An Access Control Error vulnerability exists in Devolutions Server version 2025.1.7.0 and prior versions, which stems from improper access control for...
CVE-2024-52516
Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 o...
CVE-2024-42604
Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/admingroup.php?mode=deleteid=3...
CVE-2024-22720
Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature...
CVE-2024-40036
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/userGroupdeal.php?mudi=add=close...
๐ ABB Cylon Aspect 3.08.03 Authentication Bypass
ABB Cylon Aspect version 3.08.03 BMS/BAS is vulnerable to a critical flaw in the AuthenticatedHttpServlet within its application server, enabling remote attackers to bypass authentication by setting the Host: 127.0.0.1 header. This deceives the server into processing requests as if they originate...
CVE-2022-0549
An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not...
CVE-2021-1925
Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...
CVE-2002-2264
Unspecified vulnerability in Internet Group Management Protocol IGMP of HP Tru64 4.0F through 5.1A allows remote attackers to cause a denial of service via unknown attack vectors. NOTE: this might be the same issue as CVE-2002-2185, but there are insufficient details to be certain...
Ensure That Different Group IDs Are Initially Assigned to Different Users
The initial login groups of different users must be different. If a user needs to access files in another group, you need to run a command to add the user to the group. In most cases, if the file permission and the folder permission are set to 640 and 750, respectively, users in the same group ca...
CVE-2025-21919 sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in childcfsrqonlist childcfsrqonlist attempts to convert a 'prev' pointer to a cfsrq. This 'prev' pointer can originate from struct rq's leafcfsrqlist, making the conversion invalid and...
Linux kernel ๅฎๅ จๆผๆด
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from the presence of data contention in sysctligmpqrv...
CVE-2025-24892
OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a...