Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to a missing check in the AuthRequestRepository, which is exploitable via the "select account" page. An attacker can determine whether specific userIDs exist by observing responses to...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a receive contention on a completed call by rxrpc, which could lead to the leakage of user call IDs...

PT-2025-26431 · Ооо 'Оск' · Edna Chat Center

Уязвимость системы обработки обращений клиентов edna Chat Center связана с некорректной обработкой исключительных состояний. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, определить подлинные идентификаторы пользователей...

CVE-2023-28900

The Skoda Automotive cloud contains a Broken Access Control vulnerability, allowing to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number...

CVE-1999-0138

The suidperl and sperl program do not give up root privileges when changing UIDs back to the original users, allowing root access...

Inedo ProGet 安全漏洞

Inedo ProGet is a package management system from Inedo. A security vulnerability exists in Inedo ProGet versions prior to 2.17.5 that stems from a low-privileged user having access to changed information in backups, including user IDs, email addresses, and device UUIDs...

Growatt Cloud Applications 安全漏洞

Growatt Cloud Applications is a monitoring platform from Growatt, a Chinese company. A security vulnerability exists in Growatt Cloud Applications version 3.6.0 and earlier, which originates from an unauthenticated attacker who can delete the rooms of any user by knowing the user and room ID...

GHSA-7G7F-62CF-Q66H

creationtimestamp| type| source ---|---|--- 2025-02-17 00:19:09+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/4615 2025-02-17 00:20:14+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/4620 2025-02-17 00:21:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/4625 2025-02-17 00:22:16+00:00...

PT-2025-6788 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.6 Description: The issue allows an attacker to infer user IDs and other metadata from deleted direct messages DMs if someone had manually marked DMs as deleted in the database. This is possible because...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an information disclosure vulnerability that stems from not filtering private chat DM messages from deleted channel endpoints, which could disclose metadata such as user IDs. An...

PT-2025-5378 · Pam · Pam

Name of the Vulnerable Software and Affected Versions: PAM affected versions not specified Description: A specific authentication strategy allows learning the ids of PAM users associated with certain authentication types. Recommendations: At the moment, there is no information about a newer versi...

GHSA-R5J8-58V3-G23G

creationtimestamp| type| source ---|---|--- 2025-01-05 01:32:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/57 2025-01-05 01:35:35+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/79 2025-01-05 01:38:22+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/101...

DEBIAN-CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

UBUNTU-CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

PostgreSQL row security below e.g. subqueries disregards user ID changes

...

PT-2024-71: Predictable format of user identifiers in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. Web application uses an unreliable algorithm for generating user account IDs. As a result, an intruder can predict existing identifiers within the application to carry out attacks targeting the authentication mechanism...

CVE-2022-30361

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, roles, user type, license type, and personal detai...

PT-2024-32710 · Unknown · Shilpi Client Dashboard

Name of the Vulnerable Software and Affected Versions: Shilpi Client Dashboard affected versions not specified Description: This issue exists due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this by including multiple userid...

Broadcom Symantec Privileged Access Management 安全漏洞

Broadcom Symantec Privileged Access Management Broadcom Symantec PAM is a security software from Broadcom, Inc. It helps prevent security breaches by protecting sensitive administrative credentials, controlling privileged user access, proactively enforcing security policies, and monitoring and...

python-social-auth: Improper Handling of Case Sensitivity in social-auth-app-django

A flaw was found in social-auth-app-django. In affected versions of this package, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match...