CVE-2023-27035

CVE-2023-27035 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 漏洞类型： 不正确的访问控制 描述： Obsidian Canvas 1.1.9 中发现的一个问题允许远程攻击者通过画布页面上的嵌入网站发送桌面通知、录制用户音频以及其他未明确说明的影响。 影响： 恶意嵌入网站可以在未经用户许可和不知情的情况下访问 Obsidian 应用程序中的敏感 Web API。例如，它们可以在用户不知情或未明确授予权限的情况下，静默录制用户的麦克风或代表 Obsidian 应用程序发送桌面通知。 此问题的根本原因在于应用程序缺少会话权限请求处理程...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization in the SessionHasPermissionToChannel function, even when the "Allow users to view archived channels" System Console settin...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization in the SessionHasPermissionToChannel function, even when the "Allow users to view archived channels" System Console settin...

PT-2006-5563 · Telekorn · Telekorn Signkorn Guestbook

Name of the Vulnerable Software and Affected Versions: Telekorn SignKorn Guestbook SL versions 1.3 and earlier Description: The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled and the SESSIONpermission parameter is set to "yes". This can be achieved vi...