208 matches found
CVE-2023-4107 Incorrect authorization allows a user manager to update a system admin
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...
CVE-2023-4107
Mattermost: Incorrect authorization allows a user manager to update a system admin’s details (email, first name, last name) due to inadequate permission checks. Affects Mattermost server implementations documented across Red Hat, EUVD/ENISA, VERACODE, OSV, GHSA and NVD entries. The issue is descr...
PT-2023-27771
Name of the Vulnerable Software and Affected Versions Mattermost affected versions not specified Description The issue arises from Mattermost's failure to properly validate the requesting user's permissions when updating a system admin. This allows a user manager to update a system admin's detail...
CVE-2023-4107: Incorrect Authorization
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...
PT-2023-26070 · Unknown · Online Nurse Hiring System
Name of the Vulnerable Software and Affected Versions: Online Nurse Hiring System version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability found in the Profile Page of the Admin section. This type of vulnerability allows attackers to inject malicious scripts into...
CVE-2023-3587 Inconsistent state in UI after boards permission change by system admin
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions...
CVE-2023-3587 Inconsistent state in UI after boards permission change by system admin
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions...
CVE-2023-3587 Inconsistent state in UI after boards permission change by system admin
Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions...
Incorrect Authorization
github.com/mattermost/mattermost-server is vulnerable to Incorrect Authorization. The vulnerability exists because the createUserAccessToken function of user.go fails to restrict a user with permission to edit other users and to create personal access tokens from elevating their privileges to the...
GHSA-7G2V-2FRM-RG94 Mattermost Incorrect Authorization vulnerability
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin...
Mattermost Incorrect Authorization vulnerability
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin...
Code injection
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin...
CVE-2023-2515 Privilege escalation to system admin via personal access tokens
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin...
CVE-2023-2515
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin...
CVE-2023-2515: Incorrect Authorization
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin...
CVE-2020-36065
Cross Site Request Forgery CSRF vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/adminsave...
CVE-2020-36065: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/adminsave...
CVE-2020-36065
Cross Site Request Forgery CSRF vulnerability in FlyCms 1.0 allows attackers to add arbitrary administrator accounts via system/admin/adminsave...
PT-2023-11799 · Flycms · Flycms
Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: A Cross Site Request Forgery CSRF issue allows attackers to add arbitrary administrator accounts via the "system/admin/admin save" endpoint. This can be exploited by attackers to gain unauthorized access to the...
Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability
A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to inadequate protection of sensitive user information. An attacker could exploit this...