CVE-2024-55954 OpenObserve Improper Authorization Allows Admin User to Remove Root User

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint /api/orgid/users/emailid allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...

CVE-2024-55954

OpenObserve CVE-2024-55954 affects the DELETE /api/{org_id}/users/{email_id} endpoint, where insufficient role checks in remove_user_from_org allow an Admin to remove a Root user. The root cause is improper authorization within the user management endpoint, enabling a non-root to delete a highest...

OpenObserve 安全漏洞

OpenObserve is a cloud-native observability platform open-sourced by OpenObserve. A security vulnerability exists in OpenObserve versions prior to 0.14.1, which stems from insufficient role checking in the user management endpoint /api/orgid/users/emailid, which violates a predetermined permissio...

CVE-2025-22736

Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from n/a through = 1.2...

CVE-2025-22736 WordPress User Management plugin <= 1.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in WPExperts User Management allows Privilege Escalation.This issue affects User Management: from n/a through 1.2...

CVE-2025-22736 WordPress User Management plugin <= 1.2 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from n/a through = 1.2...

CVE-2025-22736

CVE-2025-22736 concerns the WordPress plugin User Management by WPExperts. The issue is described as an Incorrect Privilege Assignment vulnerability that enables Privilege Escalation . Affected software: User Management (through version 1.2, per description). Documented impact indicates an authen...

WordPress plugin User Management 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress plugin Us...

WordPress User Management plugin <= 1.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Muhamad Agil Fachrian Patchstack Alliance in WordPress Plugin User Management versions = 1.2...

Siemens User Management Component Heap-based Buffer Overflow (CVE-2024-49775

Binary data siemensumccve-2024-49775.nbin...

UBUNTU-CVE-2024-55642

In the Linux kernel, the following vulnerability has been resolved: block: Prevent potential deadlocks in zone write plug error recovery Zone write plugging for handling writes to zones of a zoned block device always execute a zone report whenever a write BIO to a zone fails. The intent of this i...

CVE-2024-13041 Incorrect User Management in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. A...

CVE-2024-13041 Incorrect User Management in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. A...

CVE-2024-13041

Summary: CVE-2024-13041 affects GitLab CE/EE versions with SAML user creation where the external groups setting overrides the external provider configuration, potentially allowing internal project/group access to non-external users. Affected versions (per sources): GitLab 16.4 up to 17.5.5 (pre-1...

The vulnerability of the Siemens User Management Component (UMC) in products such as Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, Opcenter RDL, SIMATIC PCS neo, SINEC NMS, Totally Integrated Automation Portal (TIA Portal) allows a attacker to execute arbitrary code.

The vulnerability of the Siemens User Management Component UMC in products such as Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, Opcenter RDL, SIMATIC PCS neo, SINEC NMS, and Totally Integrated Automation Portal TIA Portal is related to buffer overflow in dynamic memory...

What’s New in Rapid7 Products & Services: Q4 2024 in Review

This quarter at Rapid7 we continued to make investments across our Command Platform to provide security professionals with a holistic, actionable view of their entire attack surface - from Exposure Management to Detection and Response. Below, we’ve highlighted key releases and updates from the...

CVE-2024-12666

A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The...

CVE-2024-12666

A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The...

CVE-2024-12666

CVE-2024-12666 affects ClassCMS up to version 4.8, where a vulnerability exists in the file path "/admin?do=admin:user:editPost" in the User Management Page . The root cause is described as improper handling of insufficient privileges, enabling a remote attack. The exploit has been disclosed publ...

CVE-2024-12666 ClassCMS User Management Page admin insufficient privileges

A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The...