8259 matches found
CVE-2025-64137
CVE-2025-64137 affects the Jenkins Themis Plugin (versions 1.4.1 and earlier). The issue is a missing permission check in an HTTP endpoint, which allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server. Public references in Red Hat and GitHub advisories reite...
CVE-2025-64137
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server...
CVE-2025-64137
A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server...
PT-2025-44299
Name of the Vulnerable Software and Affected Versions Jenkins Publish to Bitbucket Plugin versions 0.4 and earlier Description A flaw exists where a missing permission check allows attackers possessing Overall/Read permission to establish a connection to a URL specified by the attacker, utilizing...
PT-2025-44288
Name of the Vulnerable Software and Affected Versions Jenkins Start Windocks Containers Plugin versions 1.4 and earlier Description A missing permission check allows attackers with Overall/Read permission to connect to a URL specified by the attacker. Recommendations Update Jenkins Start Windocks...
PT-2025-44286
Name of the Vulnerable Software and Affected Versions Jenkins Themis Plugin versions 1.4.1 and earlier Description A flaw exists in the Jenkins Themis Plugin where a missing permission check allows attackers possessing Overall/Read permission to establish a connection to a HTTP server specified b...
CVE-2025-10740
CVE-2025-10740 affects the WordPress plugin URL Shortener Plugin For WordPress (versions up to 3.0.7). The vulnerability arises from a missing capability check in verifyRequest, allowing authenticated attackers with Subscriber-level access or higher to access API functionality and modify links. T...
PT-2025-43492
In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This could lead to physical denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2025-43468
Name of the Vulnerable Software and Affected Versions MediaProvider.java affected versions not specified Description A flaw exists in multiple functions within MediaProvider.java that may allow bypassing the WRITE EXTERNAL STORAGE permission due to a missing permission check. Successful...
PT-2025-43488
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
The vulnerability of the i40e component of the Linux operating system’s kernel, which allows a hacker to trigger a service failure
The vulnerability of the i40e component in the Linux operating system’s kernel is related to insufficient validation of input data in the functions i40echeck VF Permission and i40evcdelmacaddrmsg. Exploiting this vulnerability can allow an attacker to trigger a service failure...
CVE-2025-62661 Do permission checking when getting counts of global and local edits, new articles and thanks
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension:...
CVE-2025-62661
The CVE-2025-62661 issue targets Wikimedia Foundation MediaWiki extensions (Thanks Extension and Growth Experiments Extension). The root cause is incorrect default permissions that allow access to functionality not properly constrained by ACLs. Affected products include the Thanks Extension and G...
WordPress Find And Replace content plugin cross-site scripting vulnerability
WordPress Find And Replace content plugin is a plugin used to batch find and replace the specified text in the website content, mainly used to solve the problem of batch modification in the website content update demand. A cross-site scripting vulnerability exists in the WordPress Find And Replac...
EUVD-2025-34729
Mattermost has a Missing Authorization vulnerability...
CVE-2025-58073 Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Mattermost versions 10.11.x = 10.11.1, 10.10.x = 10.10.2, 10.5.x = 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state...
CVE-2025-58073
Mattermost Server (versions 10.11.x up to 10.11.1, 10.10.x up to 10.10.2, 10.5.x up to 10.5.10) is affected by CVE-2025-58073 due to insufficient verification of a user’s permission to join a team when using the original invite token. The underlying issue is the lack of proper authorization check...
CVE-2025-58075 Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Mattermost versions 10.11.x = 10.11.1, 10.10.x = 10.10.2, 10.5.x = 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState...