16103 matches found
CVE-2025-53971 Channel and Team Membership APIs inadvertently allow loss of Member privileges.
Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint...
CVE-2025-53971 Channel and Team Membership APIs inadvertently allow loss of Member privileges.
Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint...
PT-2025-34197 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.8 Mattermost versions 9.11.x through 9.11.17 Description: Mattermost fails to properly validate authorization for team scheme role modifications. This allows Team Admins to demote Team Members to Guests...
PT-2025-34200 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.8 Mattermost versions 9.11.x through 9.11.17 Mattermost versions 10.8.x through 10.8.3 Mattermost versions 10.9.x through 10.9.2 Description: The Mattermost application fails to sanitize the team invite...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from an uncleaned Team Invitation ID, which could lead to the acquisition of a Team Invitation ID.The following versions are affected: 10.8.3 an...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost version 10.5.8 and prior versions 10.5.x and version 9.11.17 and prior versions 9.11.x, which stems from failure to properly validate authorization for tea...
CVE-2025-53971: Incorrect Authorization
Mattermost versions 10.5.x = 10.5.8, 9.11.x = 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint...
CVE-2025-47870: Missing Authentication for Critical Function
Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id...
CVE-2025-54028: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows PHP Local File Inclusion.This issue affects CF7 WOW Styler: from n/a through = 1.7.2...
Red Teaming Methodology for Design Obfuscation
The main goal of design obfuscation schemes is to protect sensitive design details from untrusted parties in the VLSI supply chain, including but not limited to off-shore foundries and untrusted end users. In this work, we provide a systematic red teaming approach to evaluate the security of desi...
Statistics on 2024 trending vulnerabilities were featured in the OIC-CERT annual report
Statistics on2024 trending vulnerabilitieswere featured in the OIC-CERT annual report. The Organisation of Islamic Cooperation OIC is the largest and most influential official intergovernmental Muslim international organization. It currently unites 57 countries with a population of about 2 billio...
Omise: Pending invites remain valid even after the inviter is removed.
The pending invites created by a removed admin remained valid, and members already added by the removed admin remained in the team with admin privileges, even after the inviter was removed...
AutoBnB-RAG: Enhancing Multi-Agent Incident Response with Retrieval-Augmented Generation
Incident response IR requires fast, coordinated, and well-informed decision-making to contain and mitigate cyber threats. While large language models LLMs have shown promise as autonomous agents in simulated IR settings, their reasoning is often limited by a lack of access to external knowledge. ...
Malicious code in @amber-team/react-modal-stack (npm)
The package @amber-team/react-modal-stack was found to contain malicious code...
Malicious code in @amber-team/sellerly-icons (npm)
The package @amber-team/sellerly-icons was found to contain malicious code...
Malicious code in @amber-team/gatsby-plugin-semrush2 (npm)
The package @amber-team/gatsby-plugin-semrush2 was found to contain malicious code...
Malicious code in @amber-team/log-uptime-deploy (npm)
The package @amber-team/log-uptime-deploy was found to contain malicious code...
Malicious code in @amber-team/react-mobx-utils (npm)
The package @amber-team/react-mobx-utils was found to contain malicious code...