CVE-2024-7953 DataEdgePlatform DataMosaix™ Private Cloud

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project...

CVE-2024-7953

CVE-2024-7953 is a Missing Authorization (CWE-862) vulnerability in Rockwell Automation DataMosaix Private Cloud versions 7.07 and prior . A threat actor with low privileges can remotely create a project and become its administrator , then create, modify, or delete that project. The CISA advisory...

CVE-2024-7953: Improper Access Control

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project...

CVE-2026-34244

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission granted by the per-project "Administration" role can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate...

EUVD-2019-6100

Malware in sbrugna...

CVE-2023-35938

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to Private without restricted, restricted users that are project administrators keep this access right. Restricted users tha...

ProjectID is disclosed and can be used for IDOR attack

I find that we click "Settings" button, we can see all the project, even the login user does not belong to the project. Using burpsuit to hijack the reqeust, we can obtain project ids. We can use projectid to perform IDOR attack. 1 create two projects: project1 and project2, and their admin is...

Atlassian Jira 8.0.0 < 8.4.3 Improper Authorization In Workflowresource Class

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 7.13.12 , 8.0.0 prior to 8.4.3 or 8.5.0 prior to 8.5.2. It is, therefore, affected by a vulnerability which permits authenticated remote attackers who do not have...

Atlassian Jira 7.13.0 < 7.13.12 Improper Authorization In Workflowresource Class

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 7.13.12 , 8.0.0 prior to 8.4.3 or 8.5.0 prior to 8.5.2. It is, therefore, affected by a vulnerability which permits authenticated remote attackers who do not have...

Atlassian Jira < 8.9.0 Improper Authorization In Project Administration

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.9.0. It is, therefore, affected by a vulnerability which permits remote attackers to obtain information about custom project avatars via an improper authorization...

CVE-2019-15013

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a projec...