GHSA-GF2Q-J2QQ-PJF2 OpenStack Keystone Allows Remote User Account Creation

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex 2012.1, allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly...

Plone Sandbox Bypass

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors...

Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs...

Jenkins allows Remote Users to Obtain Sensitive Information from a Plugin Code

Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code...

GHSA-7Q56-MP4C-GGGG Improper Access Control in Apache Hadoop

In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service...

Improper Access Control in Apache Hadoop

In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service...

GHSA-6W8C-6JRG-QWJ2 Radicale regex metacharacters injection in the user name

Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by...

TYPO3 allows remote authenticated backend users to unserialize arbitrary objects

viewhelp.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature HMAC."...

Django Middleware Enables Session Hijacking

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...

GHSA-8Q8V-28RM-QW4W Borg Improper Access Control vulnerability

Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3...

Cloud Foundry UAA Privilege Escalation

Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their...

Moodle allows remote authenticated users to cause a denial of service (invalid database records)

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service invalid database records via a series of crafted ratings operations...

Moodle doesn't properly check role

user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page...

CVE-2022-1460

CVE-2022-1460 affects GitLab versions 9.2–14.8.5, 14.9.0–14.9.3, and 14.10.0–14.10.0. The issue is improper authorization on scheduled pipelines, allowing a malicious user to run a pipeline in another user’s context. Affected software is GitLab (CI/CD feature), with the root cause described as in...

Code injection

pyscriptjs aka PyScript Demonstrator in PyScript through 2022-05-04 allows a remote user to read Python source code...

CVE-2022-27909

In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files...

Design/Logic Flaw

In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see the names of other users' files...

CVE-2022-27909

The CVE-2022-27909 entry affects Joomla component jDownloads 3.9.8.2 Stable . The vulnerability is an improper access control flaw allowing a remote user to modify parameters in the address bar and view the names of other users’ files, i.e., a confidentiality impact. NVD reports CVSS v3.1 base sc...

Alkacon OpenCMS Improper Access Control via system/workplace/views/admin/admin-main.jsp

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to 1 send broadcast messages to all users /workplace/broadcast, 2 list all users /accounts/users, 3 add webusers...

IBM Security Identity Manager缓冲区溢出漏洞

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM Corporation of the United States. The solution automates the creation, modification, re-authentication, and termination of user privileges throughout the user lifecycle and supports policy-based...