421 matches found
Design/Logic Flaw
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the allpublicstreams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization...
CVE-2021-30479
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the allpublicstreams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization...
CVE-2021-30479
CVE-2021-30479 affects Zulip Server prior to 3.4, where a bug in the all_public_streams API allowed guest users to receive message traffic from public streams that should be restricted to organization members. This could enable unintended exposure of public-stream content to non-members. Multiple...
Zulip 安全漏洞
Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in Zulip Server versions prior to 3.4 that stems from a public API that causes guest users to be able to receive message traffic from a public stream that should only be accessibl...
UBUNTU-CVE-2021-22172
Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page...
GitLab: Guest Users can create issues for Sentry errors and track their status
Summary According to the permission docs and Error Tracking Docs , only User with role Reporter or more can see or modify the Error Tracking details. However, the "Create Issue" allows a particular Guest user to create a reference issue for the error and track its status whenever some other user...
GitLab: Guest users can create new test cases
Summary According to the permission docs and test case docs , only user with a role Reporter or more is allowed to create a test case. This vulnerability allows, even Guest role users to create new test cases. Steps to reproduce 1. Consider a private project with Guest role user. 2. Consider the...
Insecure Access Controls
Xen is vulnerable to denial of service. Unprivileged guest users are able to obtain and modify permissions, list and delete root nodes. This is due to permissions that are not properly enforced...
JetBrains TeamCity 安全漏洞
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. An unauthorized vulnerability exists in JetBrains...
GitLab Information Disclosure Vulnerability (CNVD-2021-26075)
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. An information disclosure vulnerability exists in GitLab that stems from membership changes not bei...
CVE-2020-13346
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API...
CVE-2020-13346
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API...
Open-Xchange: SSRF - Unchecked Snippet IDs for distributed files
ManagedFile ManagedFiles are basically just temporary files with some ID used for various purposes. When a managed file is created, it is registered in the local file map, which is just an internal map from StringUUID to ManagedFile, and optionally also in the distributed file map, which is a...
QEMU: seccomp: blacklist is not applied to all threads
qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service guest crash by leveraging mishandling of the seccomp policy for threads other than the main thread...
Joomla! 2.5.x < 3.9.19 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.19. It is, therefore, affected by multiple vulnerabilities : - Lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" module...
Joomla 2.5.x < 3.9.19 Multiple Vulnerabilities (5812-joomla-3-9-19)
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.19. It is, therefore, affected by multiple vulnerabilities. - In Joomla! before 3.9.19, lack of input validation in the heading tag option of the Articles - Newsflash and Article...
CVE-2020-13270
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...
Design/Logic Flaw
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...
CVE-2020-13270
CVE-2020-13270 affects GitLab Community and Enterprise Editions (CE/EE) from 11.3 up to 13.0.1, due to a missing permission check when creating fork relations. The underlying issue allows guest users to create fork relationships on restricted public projects via the API. The available sources con...