CVE-2022-0549

An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not...

CVE-2021-1925

Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

CVE-2002-2264

Unspecified vulnerability in Internet Group Management Protocol IGMP of HP Tru64 4.0F through 5.1A allows remote attackers to cause a denial of service via unknown attack vectors. NOTE: this might be the same issue as CVE-2002-2185, but there are insufficient details to be certain...

Ensure That Different Group IDs Are Initially Assigned to Different Users

The initial login groups of different users must be different. If a user needs to access files in another group, you need to run a command to add the user to the group. In most cases, if the file permission and the folder permission are set to 640 and 750, respectively, users in the same group ca...

CVE-2025-21919 sched/fair: Fix potential memory corruption in child_cfs_rq_on_list

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in childcfsrqonlist childcfsrqonlist attempts to convert a 'prev' pointer to a cfsrq. This 'prev' pointer can originate from struct rq's leafcfsrqlist, making the conversion invalid and...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from the presence of data contention in sysctligmpqrv...

CVE-2025-24892

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a...

CVE-2025-24892

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a...

CVE-2025-24892

CVE-2025-24892 affects OpenProject prior to 15.2.1, where the Group Management UI fails to sanitize user input, allowing HTML/script content in groups to be rendered in a project (stored HTML injection). The issue is resolved in OpenProject 15.2.1. If upgrading isn’t possible, a patch is availabl...

CVE-2025-24892 OpenProject stored HTML injection vulnerability

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a...

CVE-2025-24892: Improper Neutralization of Input During Web Page Generation

OpenProject is open-source, web-based project management software. In versions prior to 15.2.1, the application fails to properly sanitize user input before displaying it in the Group Management section. Groups created with HTML script tags are not properly escaped before rendering them in a...

OpenProject 跨站脚本漏洞

OpenProject is a web-based project management software from OpenProject Open Source. A cross-site scripting vulnerability exists in versions of OpenProject prior to 15.2.1, which stems from a failure to properly clean up user input in the group management section and could lead to a cross-site...

PT-2025-6068

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 15.2.1 Description The issue arises from the application's failure to properly sanitize user input before displaying it in the Group Management section. Specifically, groups created with HTML script tags are not...

PT-2025-8871

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential issue in the Linux kernel has been identified, related to the igmp6 send function. This function can be called without the necessary synchronization, potentially leading to a...

CVE-2024-53355

Multiple incorrect access control issues in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealias route; 4 delete users via the...

CVE-2024-53357

Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.0 and CO2Scope = 1.3.0 allows remote authenticated attackers, with low privileges, to 1 add an admin user via the /api/user/addalias route; 2 modifiy a user via the /api/user/updatealiasroute; 4 delete users via the /api/user/delali...

PT-2025-2959 · Easyvirt · Easyvirt Dcscope +1

Name of the Vulnerable Software and Affected Versions: EasyVirt DCScope versions 8.6.0 and earlier EasyVirt CO2Scope versions 1.3.0 and earlier Description: The issue allows remote authenticated attackers with low privileges to perform various unauthorized actions. This includes adding an admin...

Teradata 安全漏洞

Teradata is a cloud analytics and data platform from Teradata, Inc. A security vulnerability exists in Teradata version 2024-11-04 and earlier, which stems from the incorrect administration of groups when the operating system is migrated from SUSE Enterprise Linux Server 12 SP2 or SP3 to SLES 15...

PT-2024-36796 · Unknown +1 · Vaultwarden +1

Name of the Vulnerable Software and Affected Versions: vaultwarden versions 1.32.6 and earlier Description: vaultwarden, an unofficial Bitwarden compatible server written in Rust, is susceptible to a manipulation issue affecting group management. An attacker with a user account on the server,...

SUSE CVE-2024-36467

An authenticated user with API access e.g.: user with default User role, more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group e.g.: Zabbix Administrators, except to groups that are disabled or having restricted GUI access...