Improper access control

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface...

CVE-2023-29922

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface...

CVE-2023-29922

PowerJob V4.3.1 is affected by an Incorrect Access Control vulnerability in the create user/save interface. The root cause is insufficient authorization checks on the /user/save flow, potentially allowing an attacker to bypass authentication and perform unauthorized user creation. Documented deta...

CVE-2023-29923

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface...

CVE-2023-29923

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface...

CVE-2023-29922

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface...

CVE-2023-29923

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface...

CVE-2023-29922

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface...

CVE-2023-29923

PowerJob CVE-2023-29923 affects PowerJob

CVE-2023-29921

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface...

CVE-2023-29921

PowerJob V4.3.1 is affected by Incorrect Access Control via the create app interface, enabling an attacker to create apps without permission. The issue is described in multiple sources (e.g., Red Hat, GHSA/OSV, Veracode) as improper access control. Veracode notes the vulnerable flow through the /...

CVE-2023-29921

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface...

CVE-2020-19002

Cross Site Scripting XSS in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632...

CVE-2020-19002

Cross Site Scripting XSS in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632...

CVE-2020-19002

Mezzanine 4.3.1 is affected by a cross-site scripting (XSS) vulnerability that allows remote attackers to execute arbitrary code through the Description field in admin/blog/blogpost/add/. Root cause is XSS in the Description field, distinct from CVE-2018-16632. No exploit status or patch details ...

GHSA-C4QR-GMR9-V23W Prefix escape

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...

Prefix escape

Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...

CVE-2018-16632

Mezzanine CMS v4.3.1 is affected by CVE-2018-16632. The vulnerability is a Cross Site Scripting (XSS) flaw triggered via the title parameter in the admin/blog/blogcategory/add/ flow, specifically through the URL /admin/blog/blogcategory/add/?_to_field=id&_popup=1 on the related admin/blog/blogpos...

Mutualaid CMS v4.3.1 - SQL Injection Web Vulnerability

Document Title: =============== Mutualaid CMS v4.3.1 - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1858 Release Date: ============= 2016-06-20 Vulnerability Laboratory ID VL-ID: ==================================== 185...