72 matches found
CVE-2024-25168: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interface...
PT-2024-20796 · Snow Snow · Snow Snow
Name of the Vulnerable Software and Affected Versions: snow snow version 2.0.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the dataScope parameter of the "system/role/list" interface. This enables the attacker to potentially access and manipulate...
DingFlow 安全漏洞
DingFlow is DingFlow open source is committed to helping small and medium-sized intelligent office system. DingFlow v.2.0.0 version of a security vulnerability , the vulnerability stems from the system/role/list interface of the dataScope parameter SQL injection vulnerability...
CVE-2024-24062
springboot-manager v1.6 is vulnerable to Cross Site Scripting XSS via /sys/role...
springboot-manager Security Vulnerability
springboot-manager is a backend management system based on SpringBoot + Thymeleaf + Layui + Apache Shiro + Redis + Mybatis Plus by Chinese liwenbin individual developer. A security vulnerability exists in springboot-manager v1.6, which originates from an easy cross-site scripting attack via...
CVE-2024-0784
A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/role/list. The manipulation of the argument dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to...
PT-2024-15817 · Unknown · Hongmaple Octopus +1
Name of the Vulnerable Software and Affected Versions: hongmaple octopus version 1.0 biantaibao octopus version 1.0 Description: A critical issue has been found, affecting an unknown function of the file /system/role/list. The manipulation of the dataScope argument leads to sql injection. It is...
CVE-2024-0784: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/role/list. The manipulation of the argument dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to...
Octopus Deploy SQL Injection Vulnerability
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. A SQL injection vulnerability exists in Octopus Deploy version 1.0, which stems from /system/role/list containing unknown functions that cause SQL injection via the...
Privilege Escalation
mattermost is vulnerable to privilege escalation. An attacker with system role permission can read DM conversations...
GHSA-H8WH-F7GW-FWPR Mattermost Incorrect Authorization vulnerability
Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation...
CVE-2023-5193
Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation...
Design/Logic Flaw
Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation...
CVE-2023-5193
Mattermost CVE-2023-5193 describes a permissions flaw where a System Role with the permission to manage channels can read posts in direct messages due to improper permission checks. The issue has been associated with Mattermost Server versions prior to 7.8.10, 8.0.x prior to 8.0.2, and 8.1.0 (per...
CVE-2023-5193 System Role with manage posts permission can read posts of Direct Messages
Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation...
CVE-2023-5193 System Role with manage posts permission can read posts of Direct Messages
Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation...
CVE-2023-5193 System Role with manage posts permission can read posts of Direct Messages
Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation...
PT-2023-31901 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: Mattermost fails to properly check permissions when retrieving a post, allowing a System Role with the permission to manage channels to read the posts of a DM conversation...
CVE-2023-5193: Incorrect Authorization
Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation...