CVE-2025-47245

CVE-2025-47245 affects BlueWave Checkmate up to version 2.0.2 before commit d4a6072, where an invite request can be modified to specify a privileged role. The issue is documented across multiple feeds (NVD, Red Hat, OSV, NVD enrichments) with a high impact and CVSS 3.1 base score of 8.1 (CONF/INT...

CVE-2025-47245

In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role...

CVE-2025-47245

In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role...

Cisco Webex App Client-Side RCE (cisco-sa-webex-app-client-rce-ufyMMYLC)

According to its self-reported version, Cisco Webex App Client-Side Remote Code Execution is affected by a vulnerability. - A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow...

CVE-2025-20236

A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient inpu...

CVE-2025-20236

Cisco Webex App is affected by a client-side vulnerability in the custom URL parser that could allow an unauthenticated attacker to convince a user to download arbitrary files, potentially executing commands with the user’s privileges. Root cause: insufficient input validation when processing mee...

CVE-2025-20236: Inclusion of Functionality from Untrusted Control Sphere

A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient inpu...

Linux Distros Unpatched Vulnerability : CVE-2024-52815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allo...

Missing Authorization

Overview goalgorilla/opensocial is a distribution for building social communities and intranets. Affected versions of this package are vulnerable to Missing Authorization allowing users to see invites for other specific users. Remediation Upgrade goalgorilla/opensocial to version 12.3.11, 12.4.10...

CVE-2024-12869

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...

CVE-2024-12869

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...

CVE-2024-12869

CVE-2024-12869 affects infiniflow/ragflow v0.12.0 and is caused by improper authentication that lets a user view another user’s invite list, exposing personal data (emails/usernames) and enabling privacy leakage. This aligns with reported impact (data leakage leading to phishing/spam risk). Some ...

CVE-2024-12869

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...

PT-2025-12151

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow version v0.12.0 Description The issue is related to improper authentication, allowing a user to view another user's invite list. This can lead to a privacy breach, exposing personal or private information such as email...

CVE-2024-12869: Missing Authentication for Critical Function

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...

CVE-2024-43327

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Boone Gorges Invite Anyone allows Reflected XSS.This issue affects Invite Anyone: from n/a through 1.4.7...

Mattermost Server 9.11.x < 9.11.6 (MMSA-2024-00378)

The version of Mattermost Server installed on the remote host is prior to 9.11.6. It is, therefore, affected by a improper access control vulnerability as referenced in the MMSA-2024-00378 advisory. Mattermost versions 9.11.x prior to 9.11.5 fail to enforce invite permissions, which allows team...

SUSE CVE-2025-22449

Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...

CVE-2025-22449

Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...

Mattermost Incorrect Authorization vulnerability

Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...