GHSA-X3HX-CH7P-8XGG Mattermost allows regular users to access archived channel content and files

Mattermost versions 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads...

CVE-2025-41436

Mattermost versions 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads...

Prevalence of Security and Privacy Risk-Inducing Usage of AI-Based Conversational Agents

Recent improvement gains in large language models LLMs have lead to everyday usage of AI-based Conversational Agents CAs. At the same time, LLMs are vulnerable to an array of threats, including jailbreaks and, for example, causing remote code execution when fed specific inputs. As a result, users...

EUVD-2019-7725

Malware in sbrugna...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in versions of dify prior to 0.6.12, which stems from a regular user being incorrectly granted permission to edit the app name and description...

CVE-2025-29281

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them...

CVE-2025-29281

In PerfreeBlog version 4.0.11 , a Java-based blog/CMS builder, regular users can exploit an arbitrary file upload vulnerability within the attach component . This flaw allows an attacker to upload arbitrary files and subsequently execute code within them. To mitigate this risk, it is recommended ...

DRUPAL-CONTRIB-2024-068

Module to restrict access from anonymous and regular users to configured pre-defined pages. The module does not adequately handle protecting certain types of URLs...

CVE-2024-6737

The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regular privileges to access the account settings functionality and create an administrator account...

PT-2024-37833 · 2100 Technology · Electronic Official Document Management System

Name of the Vulnerable Software and Affected Versions: Electronic Official Document Management System from 2100 TECHNOLOGY affected versions not specified Description: The issue concerns improper implementation of access control in the system, allowing remote attackers with regular privileges to...

Default configuration

The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...

CVE-2023-4997 Improper authorisation in Uptime DC

Improper authorisation of regular users in ProIntegra Uptime DC software versions below 2.0.0.33940 allows them to change passwords of all other users including administrators leading to a privilege escalation...

WWBN AVideo 跨站脚本漏洞

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A cross-site scripting vulnerability exists in WWBN Avideo versions prior to 12.4, which stems from the ability for a regular user to create a meeting schedule where the user can invite other users to that meeting, but fail ...

CVE-2018-12560

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring...

Security Bulletin: IBM Robotic Process Automation may allow regular users to view some admin pages.

Summary IBM Robotic Process Automation Server prior to 21.0.1.3 may allow regular users to view some admin pages Vulnerability Details CVEID: CVE-2022-22415 DESCRIPTION: A vulnerability exists where an IBM Robotic Process Automation regular user is able to obtain view-only access to some admin...

CVE-2022-23065 Vendure - XSS via SVG File Upload

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users...

Potential Sandwich Attack: Arbitrage bots can front run reward tokens being sent to the liquidity mining contracts

Lines of code Vulnerability details Impact For the PARMiner and DemandMiner contracts, arbitrage bots could harvest significant portion of rewards by monitoring MEV, and front run any reward token either a.mimo or par being transferred to the liquidityMining contract i.e. call the deposit functio...

Mageia: Security Advisory (MGASA-2018-0314)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-30360

Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted EXE in the repair folder which runs with the Check Point Remote Access Client...

snipe-it is vulnerable to Improper Access Control

snipe-it prior to version 5.3.4 is vulnerable to Improper Access Control. Regular users with DENY set to all models permissions can still view model information via the /models/id/clone endpoint due to no authorize'view' permission being set...