GHSA-HVMF-R92R-27HR Django allows unintended model editing

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...

PYSEC-2019-15

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...

PYSEC-2019-85

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests,...

Cybozu Garoon Privilege Access Control Issue Vulnerability (CNVD-2019-12697)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A vulnerability exists in Cybozu Garoon versions 4.0.0 to 4.10.1 due to privilege permission and access control...

DRUPAL-CONTRIB-2018-002

The Node view permissions module enables the "View own content" and "View any content" permissions for each content type on the permissions page. This module has a vulnerability that allows users with these permissions to view unpublished content that they are not otherwise authorized to view. Th...

Node View Permissions - Moderately critical - Access Bypass - SA-CONTRIB-2018-002

The Node view permissions module enables the "View own content" and "View any content" permissions for each content type on the permissions page. This module has a vulnerability that allows users with these permissions to view unpublished content that they are not otherwise authorized to view. Th...

SA-CONTRIB-2013-089 - Node Access Keys - Access Bypass

Node Access Keys helps to grant users temporary view permissions to selected content types on a per user role basis. However, it only implements hooknodeaccess and not hookqueryalter, which means any listing of nodes does not respect the node view access. CVE identifiers issued CVE-2013-4596...

CVE-2013-5965

The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hookqueryalter function, which might allow remote attackers to obtain sensitive information by reading a node listing...

Design/Logic Flaw

The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hookqueryalter function, which might allow remote attackers to obtain sensitive information by reading a node listing...

CVE-2013-5965

The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hookqueryalter function, which might allow remote attackers to obtain sensitive information by reading a node listing...

CVE-2013-5965

CVE-2013-5965 : The Drupal module Node View Permissions (7.x-1.x) before 7.x-1.2 does not properly implement hook_query_alter, which may allow remote attackers to read a node listing and obtain sensitive information. Affected product: Drupal module Node View Permissions (7.x-1.x series). Root cau...

Drupal Node View Permissions module and Flag module Vulnerabilities

The drupal security team has released the following security advisories. https://drupal.org/node/2076315 https://drupal.org/node/2076221 Regards, Daniel http://www.itsecuritycenter.com/...

SA-CONTRIB-2013-072 - Node View Permissions - Access Bypass

The Node View Permissions module adds permissions "View own content" and "View any content" for each content type on the permissions page. However, it only implements hooknodeaccess and not hookqueryalter, which means any listing of nodes does not respect the node view permission. CVE identifiers...

Users with view permissions on a space are able to delete (purge) pages they don't have permission to edit/access

If a user has at least view permissions on a space they can purge any page in that space using the URL: /pages/purgetrashitem.action?key=&contentId= and the right contentId and space key. A purge can be performed even if the page has not been marked for deletion. This issue has been replicated an...