CVE-2023-4106 A guest user can perform various actions on public playbooks

Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks...

CVE-2023-22843

An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Via stored...

Input validation

An authenticated attacker with administrative access to the appliance can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will later be executed by another legitimate user viewing the details of such a rule. An attacker may be able to perform unauthorize...

CVE-2023-22843 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2

An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Via stored...

CVE-2023-22843

CVE-2023-22843 is a stored XSS vulnerability in Nozomi Guardian/CMC where an authenticated administrator can inject JavaScript into Threat Intelligence rule definitions (yara content; limited HTML for packet/STYX), which then executes in other users’ sessions. Impact includes unauthorized actions...

golang: html/template: improper sanitization of CSS values

A flaw was found in golang where angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if...

Improper Authentication

matrix-appservice-bridge is vulnerable to Improper Authentication. The vulnerability exists in postExchangeOpenId function at api.ts because it does not reject foreign users in OpenID responses which allows an attacker to perform unauthorized actions as the spoofed user...

Huawei EulerOS: Security Advisory for libwebp (EulerOS-SA-2023-2588)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CartFlows Pro < 1.11.13 - CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

INCORRECT ACCESS CONTROL

Lines of code Vulnerability details Impact Access control plays an important role in segregation of privileges in smart contracts and other applications. If this is misconfigured or not properly validated on sensitive functions, it may lead to loss of funds, tokens and in some cases compromise of...

Improper Access Control

gitlab is vulnerable to Improper Access Control. An attacker could exploit this vulnerability by sending a specially crafted request to the GitLab server. This request would allow the attacker to perform any action that is allowed for the group or project, even if they do not have permission to...

Improper Access Control

samba is vulnerable to Improper Access Control. The vulnerability exists due to improper check attribute access rights for LDAP adds of computers which allows an attacker to perform unauthorized actions...

Improper Authorization

gitlab is vulnerable to Improper Authorization. The vulnerability exists because of not verifying proper access rights to import members from a target project which allows an attacker to perform unauthorized actions...

Improper Authorization

gitlab is vulnerable to Improper Authorization. The vulnerability exists due to improper access to some particular fields through the GraphQL API which allows an attacker to perform unauthorized actions...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists due to improper restrictions in settings which allows an attacker to gain view access and perform unaothorized actions...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists because the requirement to enforce 2FA is not honored when using git commands allowing an attacker to perform unauthorized actions...

Cross-Site Scripting (XSS)

gitlab is vulnerable to Cross-Site Scripting XSS attacks. An attacker could gain access to an integration's access token, which could then be used to impersonate the integration and perform unauthorized actions...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. An attacker can send a malicious link to a victim and trigger actions on their behalf if they clicked it...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. This vulnerability occurs due to a flaw in the way that GitLab handles GraphQL mutations. An attacker can exploit this vulnerability to perform Git actions even if they are not authorized to do so...

OESA-2023-1476 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to...