CVE-2020-4040

Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized...

CVE-2020-13263

An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions...

UBUNTU-CVE-2024-3976

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to...

CVE-2024-49360

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user UserA with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders C:\Sandbox\UserB\xxx. An authenticated attack...

PT-2025-5692 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.0 through 16.9.7 GitLab CE/EE versions 16.10 through 16.10.5 GitLab CE/EE versions 16.11 through 16.11.2 Description: An issue has been discovered in GitLab CE/EE that affects the confidentiality of issues in public...

CVE-2025-24024 Mjolnir v1.9.0 accepts commands from any room

Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature tha...

CVE-2025-23369

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This...

CVE-2025-23369

CVE-2025-23369 affects GitHub Enterprise Server and centers on an improper verification of the cryptographic signature that can enable signature spoofing for unauthorized internal users. Public details indicate that versions before 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0 are impacted. Some c...

CVE-2025-21187

Microsoft Power Automate Remote Code Execution Vulnerability...

Privilege Escalation

Drupal Core is vulnerable to Privilege Escalation. The vulnerability is due to improper validation of user roles and permissions, which allows unauthorized users to bypass access restrictions and gain elevated privileges...

Amazon Linux 2 : jetty (ALAS-2024-2702)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2702 advisory. There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service DoS attack on the server using DosFilter. By repeatedly sending...

Oqtane Framework Insecure Direct Object Reference vulnerability

Oqtane Framework is vulnerable to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter...

CVE-2024-56349

In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs...

CVE-2024-56349

CVE-2024-56349 affects JetBrains TeamCity prior to 2024.12. The issue is an improper access control that allows unauthorized users to modify build logs, potentially compromising log integrity. Root cause is insufficient authorization checks on build log modificationacross multiple sources (Red Ha...

Insufficient Access Control

Moodle is vulnerable to Insufficient Access Control. The vulnerability is due to improper validation in the external API for the Quiz module, allowing unauthorized users to override access controls...

PT-2024-33555 · Foundry · Foundry

Name of the Vulnerable Software and Affected Versions: Foundry affected versions not specified Description: A software bug could allow users without permission to view restricted objects directly through the Object Explorer under specific circumstances. This issue did not make data available acro...

Bykea: Ability to increase any customer offered fare (BAC)

A business logic flaw was discovered that allowed a malicious passenger or driver acting as a passenger to increase the fare of another customer's ride without their involvement. By chaining two unauthenticated endpoints, an attacker could cause an inflated fare to appear on the driver's screen...

CVE-2024-11075

The CVE-2024-11075 entry concerns SICK’s Incoming Goods Suite. The description attributes privilege escalation to the use of component vendor Docker images running with root permissions, enabling an unprivileged user with local access to gain administrative control over the system. Affected produ...

CVE-2021-3986

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...

HCL Connections 安全漏洞

HCL Connections is a suite of enterprise collaboration platforms from HCL Corporation, USA. A security vulnerability exists in HCL Connections that stems from unauthorized users updating data in certain circumstances...