CVE-2016-0320: Improper Access Control

IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects. This could affect the behavior of legitimately triggered processes...

CVE-2016-6068: Exposure of Sensitive Information to an Unauthorized Actor

IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties...

Algolia: Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed.

Summary ------------- Invited team members or collaborators on https://www.algolia.com/manage/applications/APPID/team can use the /1/admin/ REST endpoints to leak some information, which they should not be able to have access to. Steps to reproduce -------------- 1. Invite a new team member to yo...

Several XSS flaws in the /rest/tinymce/1

I've found several XSS in the urls and parameters listed below. The criticality of the issues is moderated since only browsers that perform content sniffing would be affected e.g. IE7. This limitation comes from the response's Content Type header being set as text/plain. The classical payload...