CVE-2025-2480

Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitrary code by a local attacker...

CVE-2025-2480

Santesoft Sante DICOM Viewer Pro is affected by an out-of-bounds write when a user opens a malicious DCM file, enabling arbitrary code execution by a local attacker. This is a local-exploit scenario, requiring user interaction to open the crafted file. Affected software is the Sante DICOM Viewer ...

CVE-2025-2480 Santesoft Sante DICOM Viewer Pro Out-of-bounds Write

Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitrary code by a local attacker...

CVE-2025-2480 Santesoft Sante DICOM Viewer Pro Out-of-bounds Write

Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitrary code by a local attacker...

CVE-2025-0628

An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the applicatio...

CVE-2024-10273

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to...

CVE-2025-0628 Improper Authorization in BerriAI/litellm

An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the applicatio...

CVE-2024-10273

CVE-2024-10273 affects lunary-ai/lunary v1.5.0. The vulnerability stems from improper privilege management in the models.ts file, where the PATCH endpoint lacks sufficient privilege checks, allowing users with a viewer role to modify models owned by others. The impact is unauthorized changes to c...

CVE-2024-10273 Improper Privilege Management in lunary-ai/lunary

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to...

PT-2025-12318

Name of the Vulnerable Software and Affected Versions BerriAI/litellm version main-latest Description The issue is related to improper authorization. When a user with the role internal user viewer logs into the application, they are provided with an overly privileged API key. This key allows acce...

Santesoft Sante DICOM Viewer Pro 缓冲区错误漏洞

Santesoft Sante DICOM Viewer Pro is a professional medical image DICOM workstation and viewer from Santesoft. It is used to view, edit and convert DICOM format medical image files. A buffer error vulnerability exists in Santesoft Sante DICOM Viewer Pro 14.1.2 and prior versions, which stems from...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization in model/role.go. A user with the Viewer role, configured with No Access to Reporting, can access team and site statistics...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in model/role.go. A user with the Viewer role, configured with No Access to Reporting, can access team and site statistics. Remediation Upgrade github.com/mattermost/mattermost/server/public/model to version 0.1....

GHSA-FQRQ-XMXJ-V47X Mattermost Fails to Properly Perform Viewer Role Authorization

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

Mattermost Fails to Properly Perform Viewer Role Authorization

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

CVE-2025-1472

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

CVE-2025-1472 Unauthorized View Access to Site Statistics and Team Statistics

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

CVE-2025-1472

CVE-2025-1472 corresponds to Mattermost where versions 9.11.x up to 9.11.8 suffer from an authorization flaw in the Viewer role (configured with No Access to Reporting) that allows viewing team/site statistics. The CVE entry indicates a CVSSv3.1 base score of 4.3 (Medium) with Network attack vect...

CVE-2025-1472 Unauthorized View Access to Site Statistics and Team Statistics

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from improper authorization of the Viewer role, which can be exploited by an attacker to still view team and site statistics...