CVE-2024-45932

Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...

CVE-2024-45932

Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...

CVE-2024-45932

Krayin CRM v1.3.0 is affected by a Cross-Site Scripting (XSS) vulnerability in the organization name field of /admin/contacts/organizations/edit/2. The issue is caused by improper input validation/escaping, allowing attacker-supplied scripts to be reflected to users. Documentation from multiple s...

CVE-2024-45932

Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...

CVE-2024-45932

Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...

CVE-2024-42167

The function "generateappcertificates" in controllers/saml2/saml2.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicio...

lunary access control error vulnerability (CNVD-2025-09699)

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from improper access control and can be exploited by an attacker to change the name of an organization...

CVE-2024-6086

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify...

CVE-2024-6086

CVE-2024-6086 affects lunary-ai/lunary v1.2.7, where improper access control lets any authenticated user, including low-privilege roles like Prompt Editor, modify an organization’s name. Root cause: checkAccess() is not implemented, enabling attribute modification without proper authorization. Ex...

lunary 访问控制错误漏洞

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from improper access control and can be exploited by an attacker to change the name of an organization...

CVE-2024-1902

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker...

CVE-2024-1902

CVE-2024-1902 affects lunary-ai/lunary. The issue is a session-reuse vulnerability where a removed user can alter an organization’s name using an old authorization token via the orgs.patch route. Root cause: lack of validation to verify membership in the organization before permitting changes, du...

CVE-2024-1902 Session Reuse Vulnerability in lunary-ai/lunary

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker...

PT-2024-18409 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary affected versions not specified Description: The issue allows a removed user to change the organization name without proper authorization due to the lack of validation to check if a user is still part of an organization befor...

VMware Cloud Director Information Disclosure Vulnerability

VMware Cloud Director is a cloud service delivery platform from VMware. The platform supports virtual datacenter creation, multi-site management, datacenter scaling and cloud migration, and cloud-native application development. An information disclosure vulnerability exists in VMware Cloud...

CVE-2024-25602

Stored cross-site scripting XSS vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject...

Liferay Portal and Liferay DXP Security Vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

Tolgee Input Validation Error Vulnerability

Tolgee is an open source multilingual translation and localization platform designed to help development teams easily manage and maintain multilingual software applications and websites. An input validation error vulnerability exists in Tolgee version v3.29.1 and prior versions, which stems from...

dmarcts-report-viewer 跨站脚本漏洞

dmarcts-report-viewer is a PHP viewer for DMARC records by TechSneeze Individual Developers. A security vulnerability exists in dmarcts-report-viewer dashboard version 1.1. An attacker can exploit this vulnerability to execute arbitrary code via the orgname or domain value...

SUSE CVE-2017-7538

A cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users...