1963 matches found
CVE-2023-1702
creationtimestamp| type| source ---|---|--- 2023-03-29 20:31:03+00:00| seen| https://t.me/cibsecurity/61033...
The vulnerability of the stat() function in the OverlayFS subsystem of Linux kernels allows attackers to increase their privileges.
The vulnerability of the stat function in the OverlayFS subsystem of Linux operating systems is related to deficiencies in access control when processing setuid and setgid attributes. Exploiting this vulnerability can allow attackers to enhance their privileges...
CVE-2023-24625
Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference IDOR attack...
Design/Logic Flaw
Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference IDOR attack...
Improper Authorization
nilsteampassnet/teampass is vulnerable to Improper Authorization. The vulnerability allows an attacker with low-level privileges to logout everyone out including the admin due to an Insecure Direct Object References IDOR via the user ID...
CVE-2023-27569
creationtimestamp| type| source ---|---|--- 2023-03-21 19:35:04+00:00| seen| https://t.me/cibsecurity/60395...
answer 安全漏洞
answer is an open source knowledge-based community software. answer 1.0.6 prior versions of the authorization problem vulnerability , the vulnerability stems from the request to set a new password in /answer/admin/api/user/password there is improper permission management , a low-privilege attacke...
Stored Cross-Site Scripting (XSS)
moodle/moodle is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to a lack of HTML sanitization in the the user ID when exporting to data formats supporting HTML which allows an attacker to inject and execute arbitrary JavaScript when a user clicks on the downloaded file. Not...
Stored Cross-Site Scripting (XSS)
moodle/moodle is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to the quiz override page via the user ID which allows an attacker to inject and execute arbitrary JavaScript in the browser...
CVE-2023-21456
Path traversal vulnerability in Galaxy Themes Service prior to SMR Mar-2023 Release 1 allows attacker to access arbitrary file with system uid...
CVE-2023-28144
creationtimestamp| type| source ---|---|--- 2023-03-14 21:23:15+00:00| seen| https://t.me/cibsecurity/60021...
CVE-2023-0021
Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed...
CVE-2023-24579
creationtimestamp| type| source ---|---|--- 2023-03-13 15:53:23+00:00| seen| https://t.me/cibsecurity/59889...
SUSE CVE-2023-1076
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAPNETADMIN, it may not always be the case, e.g., a non-root user only having that...
CVE-2023-20939
creationtimestamp| type| source ---|---|--- 2023-02-28 20:27:53+00:00| seen| https://t.me/cibsecurity/59127 2025-03-21 18:20:04+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8403...
CVE-2022-47179
creationtimestamp| type| source ---|---|--- 2023-02-28 18:27:55+00:00| seen| https://t.me/cibsecurity/59111...
CVE-2015-10086
creationtimestamp| type| source ---|---|--- 2023-02-28 02:27:04+00:00| seen| https://t.me/cibsecurity/59077...
WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR
The plugin does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users. Run t...