Dradis Framework 安全漏洞

Dradis Framework is an open source collaboration framework for IT security from Dradis Framework. A security vulnerability exists in Dradis Framework versions prior to 4.11.0, which stems from the output console displaying a job queue that may contain information about other users' jobs...

DRUPAL-CONTRIB-2025-085

This module enables you to allow and/or require a second authentication method in addition to password authentication. The module does not sufficiently ensure that users with enhanced privileges are prevented from viewing recovery codes of other users. This vulnerability is mitigated by the fact...

Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085

This module enables you to allow and/or require a second authentication method in addition to password authentication. The module does not sufficiently ensure that users with enhanced privileges are prevented from viewing recovery codes of other users. This vulnerability is mitigated by the fact...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle, which stems from an insecure direct object reference flaw that can be exploited by...

CVE-2024-22343

IBM TXSeries for Multiplatforms 8.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 280190...

CVE-2022-34354

IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424...

Nextcloud: Missing ownership check in Tables app allows moving columns into tables of other users

The Tables app in the specified software had a vulnerability that allowed moving columns into tables of other users without proper ownership checks...

UBUNTU-CVE-2025-3640

A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access...

SUSE CVE-2025-27538

Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with editotherusers permission to activate or deactivate MFA for other users, even if those users have not...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function over the PUT /api/v4/users/user-id/mfa endpoint. This allows a user with editotherusers permission to activate or deactivate multi-factor authentication for other users. Remediation Upgrade...

CVE-2025-27538 MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with editotherusers permission to activate or deactivate MFA for other users, even if those users have not...

PT-2025-16565

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.9 Mattermost versions 10.5.x through 10.5.1 Description The issue arises from the failure to enforce MFA checks in the PUT /api/v4/users/user-id/mfa endpoint when the requesting user differs from the...

CVE-2025-31945

An unauthenticated attacker can obtain other users' charger information...

CVE-2025-31950

An unauthenticated attacker can obtain EV charger energy consumption information of other users...

CVE-2025-24850

An attacker can export other users' plant information...

CVE-2025-24315

Unauthenticated attackers can add devices of other users to their scenes or arbitrary scenes of other arbitrary users...

PT-2025-16497

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An attacker can export other users' plant information. This issue allows unauthorized access to sensitive data belonging to other users. Recommendations At the moment, there is no information...

PeerTube 安全漏洞

PeerTube is a decentralized video sharing service platform open-sourced by Chocobozzz. It is used for producing video projects. PeerTube suffers from a security vulnerability that stems from a lack of permission validation, which could lead to adding playlists to other users' channels...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in that a user with the "Edit Other Users" permission set, but not broader high-level permissions, can modify the properties of admin accounts. Remediation Upgrade...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization in that a user with the "Edit Other Users" permission set, but not broader high-level permissions, can modify the properti...