4681 matches found
CVE-2021-22193
An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project...
PT-2021-14904 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 7.1 and later Description: An issue has been discovered in GitLab where a member of a private group was able to validate the use of a specific name for a private project. Recommendations: For GitLab versions 7.1 and later, at...
VK.com: Member still able close another user poll on communities topic
Insufficient validation in closing the poll of the community topic...
Information disclosure
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider...
CVE-2021-20440
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider...
CVE-2021-20440: Undefined Security Weakness
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider...
PT-2021-13967
Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 Description: The issue allows an attacker who is a valid user in the user registry used by API Manager to register themselves as a member of an API provider organization...
CVE-2021-20440
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user in the user registry used by API Manager can use a stolen invitation link and register themselves as a member of an API provider...
Command Execution Vulnerability in Chase T Series Ledger System
Ltd. is a member company of UFIDA. Changjitong is committed to providing social, personalized, service-oriented and small business management support for small and medium-sized enterprises. A command execution vulnerability exists in the Changjitong T-Series Ledger System. An attacker can exploit...
Shopify: staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings Permission
Hi, The staff order notification should be under the control of staff members with Order permission but I found that the staff member with just Settings permission can also delete the order notifications using the GID Steps to reproduce - Login as a staff member with Settings permission - Make th...
Shopify: staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings Permission
Hi, I found that the GraphQL call staffOrderNotificationSubscriptionCreate is not blocked from the staff member with Settings permission Steps to reproduce - Login as a staff member with Settings permission - Make this GraphQL call to...
Apple macOS Security Breach
Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS due to an incorrect access restriction within the Messages component of macOS. A remote user who is removed from an iMessage group can rejoin the group. The...
Shopify: [h1-2102] Partner's team member with no permission can retrieve services financial data
Details Unfortunately, I wasn't able to properly validate the following report as I could not get access the my partner's services option event is ending in a few hours and that access is manually given https://help.shopify.com/en/partners/selling-services. However, given the observed behaviour, ...
HackerOne: Ability to invite a new member on Sandbox Program
In the description HackerOne offers a sandbox for hackers to help them test program functionality for security vulnerabilities. To create a program, go here. You can select any product edition, giving you access to almost all features HackerOne offers. Hackers can create up to 30 programs in the...
WordPress Ultimate Member Plugin <= 2.1.12 Deprecated UM Forms Field Vulnerability
The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
WordPress Ultimate Member plugin input validation error vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. An input validation error vulnerability...
CVE-2020-36170
The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms...
CVE-2020-36170
The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms...
