Team Members < 5.1.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed The teamcolor field ie "Main color" setting of a team is affected POST /wp-admin/post.php HTTP/1.1 Accept:...

GitLab 访问控制错误漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. An Access Control Error vulnerability exists in Gitlab Community Edition versio...

Shopify: Collaborators and Staff members without all necessary permissions are able to create, edit and install custom apps

Summary: Custom Apps - Permissions The store owner, collaborators and staff members can create, edit and install custom apps for their shopify store. Therefor, these users need multiple permissions. The permissions View apps developed by staff and collaborators Develop apps and Manage and install...

CVE-2022-29585

In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list rather than only being shown for the institution that the viewer is a member of...

GHSA-QGGC-PJ29-J27M Improper Privilege Management in Mattermost

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents. Per the Mattermost security updates...

CVE-2022-1332 Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents...

CVE-2022-27162

CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcmsadminMemberseditUser...

CVE-2022-27161

Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcmsadminMembersviewUsers...

CSZ CMS SQL注入漏洞

CSZ CMS is a PHP-based open source content management system CMS. cszcmsadminMembersviewUsers version 1.2.2 contains a SQL injection vulnerability, which originates from the lack of validation of externally entered SQL statements and can be exploited by attackers to execute illegal SQL commands t...

CSZ CMS SQL注入漏洞

CSZ CMS is a PHP-based open source content management system CMS. CSZ CMS version 1.2.2 contains a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in cszcmsadminMemberseditUser and can be exploited by attackers to execute illegal SQL...

Samsung Members Access Control Error Vulnerability

Samsung Members is a community platform app from Samsung South Korea, Inc. An access control error vulnerability exists in versions prior to Samsung Members 13.6.08.5, which stems from a lack of proper access validation logic. A local attacker could exploit the vulnerability to execute the call...

CVE-2022-28777

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALLPHONE permission...

CVE-2022-28777

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALLPHONE permission...

CVE-2022-28777

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALLPHONE permission...

Improper access control

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALLPHONE permission...

CVE-2022-28777

CVE-2022-28777 affects Samsung Members (pre-13.6.08.5). The issue is an improper access control that allows a local attacker to execute the call function without the CALL_PHONE permission. Remediation: update to version 13.6.08.5 or later. Evidence across connected documents confirms the vulnerab...

CVE-2022-28777

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALLPHONE permission...

Samsung Members 安全漏洞

Samsung Members is a community platform app from Samsung South Korea, Inc. An access control error vulnerability exists in versions prior to Samsung Members 13.6.08.5, which stems from a lack of proper access validation logic. A local attacker could exploit the vulnerability to execute the call...

PT-2022-19225 · Samsung · Samsung Members

Name of the Vulnerable Software and Affected Versions: Samsung Members versions prior to 13.6.08.5 Description: The issue is related to an improper access control vulnerability. It allows a local attacker to execute a call function without the required CALL PHONE permission. Recommendations: For...

kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS

A stack overflow flaw was found in the Linux kernel’s TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges...