GHSA-XPH3-VJCQ-G488 Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

The organization selector before 4.0.14 from Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

PT-2023-25715 · Sentry · Sentry

Name of the Vulnerable Software and Affected Versions: Sentry versions 8.21.0 through 23.5.1 Description: An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID, without needing to be a member of the organization or having...

CVE-2023-32316 Users can add themselves to any organization in CloudExplorer Lite

CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorer Lite. This is due to a missing permission check on the user profile. It is recommended to upgrade the version to v1.1.0. There are no known workarounds fo...

CloudExplorer Lite 安全漏洞

CloudExplorer Lite is CloudExplorer's platform that provides out-of-the-box cloud hosting management, cloud billing, operational analytics, and security compliance, among other essential features, along with powerful extensibility to meet the customization needs of organizations. A security...

CVE-2022-23485

CVE-2022-23485 affects the Sentry Python library prior to 22.11.0. An attacker with a known valid invite link could manipulate a cookie to reuse the same invite across multiple accounts when joining an organization, enabling creation of multiple users and unauthorized organization membership. The...

grafana: XSS vulnerability in data source handling

A Cross-site scripting XSS vulnerability was found in the way Grafana handles data sources. This flaw allows an attacker to serve HTML content through the Grafana data source or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site scripting...

CVE-2022-36051 Broken Authorization in ZITADEL Actions

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...

多款 ZITADEL 产品 安全漏洞

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless, open sourced by ZITADEL in Switzerland. ZITADEL suffers from a security vulnerability that stems from a lack of authorization checks, where Actions is abl...

PT-2022-23143 · Zitadel · Zitadel

Name of the Vulnerable Software and Affected Versions: ZITADEL versions 1.42.0 through 1.87.0 ZITADEL versions 1.56.0 through 1.87.0 ZITADEL version 2.x prior to 2.2.0 Description: The issue is related to a missing authorization check in the Actions feature, introduced in ZITADEL 1.42.0 on the AP...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.0 that stems from the ability of a user assigned to a secondary organization to see the entire organization instead of just the organization to which they are...

Zulip server 安全漏洞

Zulip server is an open source team chat application from Zulip USA. zulip server has a security vulnerability that stems from the fact that zlip Server deployments that reside in multiple organizations are vulnerable to attacks where an invitation created in one organization possibly a role with...

CVE-2021-46561

controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new...

Authorization

Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization...

Automattic: [IDOR] Attacker user can Approve/Decline AFK on the behalf of other users

Summary: Hi team Hope you are good Missing proper authorization checks on the vulnerable request allows an attacker to approve/decline afk of users on the behalf of other user who is a member of other organization. This can be exploited simply by changing the responderuserid in the vulnerable...

Cisco Webex Teams Information Disclosure and Modification Vulnerability

Cisco Webex Teams is a team collaboration application from Cisco USA. The program includes features such as video conferencing, group messaging and file sharing. An information disclosure and modification vulnerability exists in Cisco Webex Teams, which stems from the affected software performing...

Shopify: Removed staff members who had "Manage shops" permission can still create development stores

Details: It's been found that staff members of an organization in partners.shopify.com can have a permission to manage shops and those with that permission can create development stores that will be associated with the organization. When a staff member tries to create a development store, a POST...