SUSE CVE-2013-4340

wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified userID parameter...

SUSE CVE-2016-6190

SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all...

SUSE CVE-2018-8754

The libevtrecordvaluesreadevent function in libevtrecordvalues.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub...

The vulnerability of the IBM Rational Asset Manager (RAM) system, related to deficiencies in access control, allows a hacker to bypass security restrictions.

The vulnerability of the IBM Rational Asset Manager RAM system relates to deficiencies in access control when processing UID parameters. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions remotely...

GitLab Enterprise Edition和GitLab Community Edition 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab CE/EE versions 10.0 through 15.5.7 prior, 15...

CVE-2022-41675

creationtimestamp| type| source ---|---|--- 2022-11-29 07:28:52+00:00| seen| https://t.me/cibsecurity/53633...

CVE-2020-23587

creationtimestamp| type| source ---|---|--- 2022-11-23 07:13:32+00:00| seen| https://t.me/cibsecurity/53387 2025-04-25 21:08:33+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13548...

CVE-2022-41932 Creation of new database tables through login form on PostgreSQL

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas and fill them with tables just by using a crafted user identifier in the login form. This may lead to degraded database performance. The...

PT-2022-25071 · Unknown · Callbgprovider

Name of the Vulnerable Software and Affected Versions: CallBGProvider versions prior to SMR Nov-2022 Release 1 Description: The issue is related to an improper authorization vulnerability. It allows a local attacker to grant permission for accessing information with phone uid. Recommendations: Fo...

CVE-2022-22493

creationtimestamp| type| source ---|---|--- 2022-10-07 20:17:24+00:00| seen| https://t.me/cibsecurity/50994...

BigBlueButton 注入漏洞

BigBlueButton is an open source web conferencing system from the BigBlueButton community. A security vulnerability exists in BigBlueButton versions prior to 2.2.7, which stems from an unprotected mechanism for delimiter injection in meetingId, userId, and authToken...

CVE-2022-37237

creationtimestamp| type| source ---|---|--- 2022-08-30 20:35:46+00:00| seen| https://t.me/cibsecurity/49061...

DEBIAN-CVE-2021-3995

A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of...

CVE-2022-34621

Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference IDOR vulnerability which allows attackers to modify user passwords and other attributes via modification of the userid parameter...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner by an individual developer in Hayden, USA. A security vulnerability exists in Mealie version 1.0.0beta3, which stems from the inclusion of an insecure direct object reference that allows an attacker to modify a user's password and other...

CVE-2022-25228

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. A security vulnerability exists in Google Android version 13, which stems from incorrect UID permission checking in WindowManager, which may bypass the restriction of launching activities from the background, and can b...

CVE-2022-23342

creationtimestamp| type| source ---|---|--- 2022-06-21 18:27:39+00:00| seen| https://t.me/cibsecurity/44894...

Victor CMS SQL注入漏洞

Victor CMS is an open source content management system by Victor Alagwu, an individual developer in Nigeria. A security vulnerability exists in version 1.0 of Victor CMS that stems from problems with the cid parameter of admineditcomment.php, the pid parameter of admineditpost.php, the uid...

Wedding Management System SQL注入漏洞

Wedding Management System v1.0 is a wedding planning management system by John Paul Lim Gabule, a personal developer. clientassign.php?booking=31&userid=The page lacks validation of external input SQL statements, which can be exploited by attackers to execute illegal SQL commands to steal sensiti...