GHSA-4269-MCFH-CP7Q Indico may disclose unauthorized user details access via legacy API

Impact A legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check. Patches You should to update to Indico 3.3.8 as soon as possible. See the docs for instructions on how to update. Workarounds It ...

CVE-2025-10155

creationtimestamp| type| source ---|---|--- 2025-09-10 19:51:37+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-jgw4-cr84-mqxg 2025-09-17 10:31:59+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lyzmzk6thf2o 2025-09-17 11:32:14+00:00| seen|...

CVE-2025-59034

The CVE-2025-59034 affects Indico before version 3.3.8, where a legacy API for retrieving user details could disclose profile data of other users due to a broken access check in Flask-Multipass-based authentication. The issue enables unauthorized access without admin permissions; impact is limite...

CVE-2025-59034 Indico may disclose unauthorized user details access via legacy API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check...

CVE-2025-59034 Indico may disclose unauthorized user details access via legacy API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check...

CVE-2025-9943

creationtimestamp| type| source ---|---|--- 2025-09-10 08:01:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lyhre4bny42r 2025-09-10 08:46:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lyhttvtwpt2r...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

A CSV injection vulnerability in the /idprofiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file...

CVE-2025-56267

Avigilon ACM version v7.10.0.20 is vulnerable to a CSV injection vulnerability in the /id_profiles API endpoint. This flaw allows an attacker to execute arbitrary code by supplying a specially crafted Excel file. As a temporary workaround, it is recommended to restrict access to the /id_profiles ...

PT-2025-36486

Name of the Vulnerable Software and Affected Versions: Avigilon ACM version 7.10.0.20 Description: A CSV injection vulnerability exists in the /id profiles API endpoint of the software. This allows attackers to execute arbitrary code by supplying a crafted Excel file. Recommendations: As a...

CVE-2025-21037

Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is required for triggering this vulnerability...

CVE-2025-48541

In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48541

In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48541

The Android operating system contains a security vulnerability in the onCreate function of the FaceSettings.java file. Due to improper input validation , an attacker could remove biometric unlock functionality across all user profiles. This flaw facilitates a local escalation of privilege without...

CVE-2025-48541

In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48541

In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from the American company Google. Google Android suffers from a security vulnerability that stems from improper input validation and could lead to the removal of biometric unlocking functionality across user profiles...