Input validation

Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information...

CVE-2023-30703

Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information...

CVE-2023-30703

Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information...

CVE-2023-30703

Samsung Members contains an improper URL validation vulnerability (CVE-2023-30703) affecting versions prior to 14.0.07.1. The issue could allow an attacker to access sensitive information. The cited PT-2023-22903 entry confirms the vulnerable range and provides remediation guidance: upgrade to ve...

PT-2023-22903 · Samsung · Samsung Members

Name of the Vulnerable Software and Affected Versions: Samsung Members versions prior to 14.0.07.1 Description: The issue is related to improper URL validation, which allows attackers to access sensitive information. Recommendations: For versions prior to 14.0.07.1, update to version 14.0.07.1 or...

_scheduleUpdate() should be called during initialize ing the SecurityCouncilManager

Lines of code Vulnerability details Impact Updates will not be scheduled through timelocks and target upgrade executors by the scheduleUpdate call. Initial set of cohort members will not be scheduled. Proof of Concept In SecurityCouncilManager whenever a new member is added, or removed or swapped...

SAMSUNG Members Security Breach

SAMSUNG Members is a community platform app from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Members version 14.0.07.1, which stems from the presence of an incorrect URL authentication vulnerability that could allow an attacker to access sensitive...

Improper Authorization

gitlab is vulnerable to Improper Authorization. This vulnerability allows project members to manage issues in the error tracking feature if they are assigned the reporter role...

Business Logic Flaws

GitLab is vulnerable to Business Logic Flaws. The vulnerability exists under specific conditions, which allows an unauthorised project members to delete a protected branches...

HackerOne: Staff and Triage can modify the initial post of a report, including of already disclosed reports

The initial post of a report on HackerOne could be modified by program members and Triage, allowing them to change the information and potentially manipulate the narrative of the report...

Silverstripe Framework: Members with no password can be created and bypass custom login forms

When a new Member record was created in the cms it was possible to set a blank password. If an attacker knows the email address of the user with the blank password then they can attempt to log in using an empty password. The default member authenticator, login form and basic auth all require a...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability allows anuthorized users to see release names even when releases are restricted to project members only...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs...

CVE-2023-33265

In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted...

WordPress Team Members – Best WordPress Team Plugin with Live Team Builder Plugin < 2.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Team Members – Best WordPress Team Plugin with Live Team Builder Type Plugin Vulnerable versions 2.8.3 Fixed in 2.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

Token holders can create as many proposals as they want if they already have an active proposal by transferring their token to another wallet.

Lines of code Vulnerability details The propose function on NounsDAOV3Proposals.sol has a check called checkNoActivePropds, msg.sender, which exists to prevent token holders from spamming the propose function. Furthermore, the proposeOnTimelockV1 function calls propose directly, making it...

The fork mechanism of Nouns lacks a fork cooling-off period/clarification period/remedial period mechanism, which cannot resist someone maliciously inciting the emotions of DAO members and triggering impulsive forks

Lines of code Vulnerability details Impact It's important that forking happen rarely. Once a fork occurs, it cannot be canceled. It is not a good thing for DAO to happen. It is necessary to ensure that DAO members propose a fork after calm deliberation. The current Nouns forking mechanism lacks a...

CVE-2023-2869

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869

CVE-2023-2869 concerns the WordPress WP-Members Membership plugin. The vulnerability arises from a missing capability check in the do_field_reorder function, allowing authenticated users with subscriber-level access to reorder form elements on login forms and thereby perform unauthorized updates ...