CVE-2024-29221

CVE-2024-29221 (Mattermost Server) describes improper access control in the /api/v4/users/me/teams endpoint, where a team admin could obtain the team invite ID and invite users despite lacking the Add Members permission. Affected versions include 8.1.x before 8.1.11, 9.x before 9.3.3/9.4.4/9.5.2....

CVE-2024-29221 Invite ID available to team admins even without the "Add Members" permission

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...

Mattermost Server 安全漏洞

Mattermost Server is an open source messaging platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost Server versions prior to 9.5.2, prior to 9.4.4, prior to 9.3.3, and prior to 8.1.11, which stems from a lack of proper access control in /api/v4/, where...

CVE-2024-29221: Improper Access Control

Improper Access Control in Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 lacked proper access control in the /api/v4/users/me/teams endpoint allowing a team admin to get the invite ID of their team, thus allowing them to invite users,...

BIT-DISCOURSE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

CVE-2024-27085

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

CVE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

CVE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

CVE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

PT-2024-21637 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: The issue affects Discourse, an open source platform for community discussion. Users allowed to invite others can inject arbitrarily large data in parameters used in the invite route...

CVE-2024-27085: Uncontrolled Resource Consumption

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

CVE-2024-2363

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Invite Handler. The manipulation of the argument CSeq leads to denial of service. The attack can be initiated remotely. The...

CVE-2024-2363

CVE-2024-2363 affects AOL AIM Triton 1.0.4, specifically the Invite Handler component. The root cause is manipulation of the CSeq argument, which leads to a remote denial of service. Public exploit details exist, and the vulnerability is associated with products no longer maintained. No patch/ver...

CVE-2024-2363 AOL AIM Triton Invite denial of service

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Invite Handler. The manipulation of the argument CSeq leads to denial of service. The attack can be initiated remotely. The...

CVE-2024-2363: Improper Resource Shutdown or Release

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Invite Handler. The manipulation of the argument CSeq leads to denial of service. The attack can be initiated remotely. The...

AOL AIM Triton Security Breach

AOL AIM Triton is an instant messaging software from AOL. A security vulnerability exists in AOL AIM Triton version 1.0.4, which stems from a denial of service due to the parameter CSeq of the component Invite Handler...

PT-2024-19983 · Aol · Aol Aim Triton

Name of the Vulnerable Software and Affected Versions: AOL AIM Triton version 1.0.4 Description: A vulnerability was found in the Invite Handler component, where the manipulation of the CSeq argument leads to denial of service. The attack can be initiated remotely. This issue affects products tha...

BIT-GITLAB-2021-22243

Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group...

BIT-DISCOURSE-2022-31096 Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse

Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite h...

BIT-MATTERMOST-2023-1774

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel...