RHEL 9 : libreoffice (RHSA-2024:1425)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1425 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor...

pdfforge PDFCreator < 5.1.2 Permission Validation Vulnerability

PDFCreator 5.1.2 contains a vulnerable version of Ghostscript SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware: Security Advisory (SSA:2024-067-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] ghostscript

New ghostscript packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/ghostscript-9.55.0-i586-2slack15.0.txz: Rebuilt. Fixes security issues: A vulnerability was identified in the way...

Insufficient Permission Validation

getgrav/grav is vulnerable to Insufficient Permission Validation. The vulnerability is due to enabling regular users with page creation privileges to access the Frontmatter feature when the datajsonheaderform parameter is included in the POST body while creating a page. The vulnerability is also...

CVE-2024-27923

CVE-2024-27923 affects Grav CMS prior to 1.7.43. The issue arises from insufficient permission validation and inadequate filename validation in the Frontmatter feature, enabling a regular page writer to inject a malicious Frontmatter that can lead to Remote Code Execution (RCE). The vulnerability...

CVE-2024-27923 Remote Code Execution by uploading a phar file using frontmatter

Grav is a content management system CMS. Prior to version 1.7.43, users who may write a page may use the frontmatter feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue...

BIT-MOODLE-2021-20283

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

BIT-GITLAB-2023-4018 Direct Request ('Forced Browsing') in GitLab

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects...

BIT-ARTIFACTORY-2021-41834

JFrog Artifactory prior to version 7.28.0 and 6.23.38, is vulnerable to Broken Access Control, the copy functionality can be used by a low-privileged user to read and copy any artifact that exists in the Artifactory deployment due to improper permissions validation...

BIT-ARTIFACTORY-2021-46270

JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all available repository names due to insufficient permission validation...

Improper Access Control

LakeFS is vulnerable to Improper Access Control. The vulnerability is due to improper permission validation, enabling users with ci:ReadAction to access unauthorized data by copying objects to accessible paths...

GLSA-202402-29 : LibreOffice: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202402-29 LibreOffice: Multiple Vulnerabilities - Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected...

Improper Access Control

pimcore/admin-ui-classic-bundle is vulnerable to Improper Access Control. The vulnerability is due to lack of permission validation while creating and deleting tags. An attacker can create and delete tags without having the permission to do so...

EulerOS 2.0 SP9 : ghostscript (EulerOS-SA-2023-2876)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the %pipe% prefix or the | pipe character prefix...

EulerOS 2.0 SP10 : ghostscript (EulerOS-SA-2023-2785)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the %pipe% prefix or the | pipe character prefix...

Improper Authorization

github.com/mattermost/mattermost is vulnerable to Improper Authorization. The vulnerability is caused due to improper permission validation while a user views archived public channels. One member of a team can view a channel of another team member via GET call to the /api/v4/teams//channels/delet...

Improper Access Control

gitlab:sid is vulnerable of improper access control. The vulnerability due to improper permission validation and fails to authorization check. It leads to allow an attacker to edit labels description by an unauthorized user...

Improper Access Control

Gitlab is vulnerable to Improper Access Control. The vulnerability is caused due to improper permission validation while granting access to git lab projects. An attacker can fork a project outside of current group and can compromise the target system...

CVE-2023-7047

Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature. This affects only SQL dat...