Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure

Executive Summary A security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django RE...

OpenProject security vulnerabilities

OpenProject is an open-source web-based project management software. Versions of OpenProject prior to 17.0.1 and 16.6.5 had security vulnerabilities. These vulnerabilities stemmed from failed permission checks, which could allow users with viewing member permissions to enumerate all groups and...

Langfuse 安全漏洞

langfuse is a large language model engineering platform open-sourced by Langfuse. A security vulnerability exists in Langfuse versions 2.70.0 up to and including 2.95.11 and 3.124.1, which stems from the server trusting a user-controlled orgId and using it for authorization checking, which could...

PT-2023-21667 · Rocket.Chat · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat affected versions not specified Description: A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command "/mute" occur after checking whether a user is a member of a given channel, leaking private...

How2ASP.net WebBoard 4.1 - SQL Injection

How2ASP.net WebBoard 4.1 - SQL Injection ========================================================== How2ASP.net Webboard 4.1 Remote SQL Injection Vulnerability ========================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH...