1687 matches found
CVE-2024-30146 HCL Domino Leap is affected by improper access control
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem...
CVE-2024-30146
The CVE-2024-30146 entry concerns HCL Domino Leap. Affected component: the endpoint handling import of applications. Root cause: improper access control allowing certain admin users to import applications from the server’s filesystem. Impact as described: potential unauthorized filesystem access ...
CVE-2024-30146 HCL Domino Leap is affected by improper access control
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem...
CVE-2025-27134 Privilege escalation in Joplin server via user patch endpoint
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/:id t...
CVE-2025-27134
CVE-2025-27134 concerns Joplin server prior to version 3.3.3, where a vulnerability in the PATCH /api/users/:id endpoint allows a non-admin user to set the is_admin field to 1. This privilege escalation enables low-privilege users to perform administrative actions without proper authorization. Th...
PT-2025-18288 · Joplin · Joplin
Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 3.3.3 Description: A privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/:id to set the is admin field to 1. This issue allows maliciou...
CVE-2024-30146: Improper Access Control
Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem...
About Elevation of Privilege – Windows Process Activation (CVE-2025-21204) vulnerability
About Elevation of Privilege - Windows Process Activation CVE-2025-21204 vulnerability. This vulnerability from the April Microsoft Patch Tuesday was not highlighted by VM vendors in their reviews. It affects the Windows Update Stack component and is related to improper link resolution before fil...
CVE-2024-12273
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Security Bulletin: IBM DataPower Gateway may permit admin users to view and edit files that are not allowed to be read via RBM access rights (CVE-2022-22326)
Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2022-22326 DESCRIPTION: IBM MQ Appliance could allow unauthorized viewing of logs and files due to insufficient authorisation checks. CVSS Base score: 4 CVSS Temporal Score: See:...
CVE-2024-9771 WP-Recall < 16.26.12 - Admin+ Stored XSS
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-0627 AI Autotagger < 3.30.0 - Admin+ Stored XSS
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...
CVE-2025-0627 AI Autotagger < 3.30.0 - Admin+ Stored XSS
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...
CVE-2025-0627
The WordPress Tag, Category, and Taxonomy Manager plugin (also referred to as TaxoPress or AI Autotagger ) versions prior to 3.30.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain Widgets settings . This flaw allows high-p...
CVE-2024-9771 WP-Recall < 16.26.12 - Admin+ Stored XSS
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-30148
Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem...
CVE-2025-0671 Email Subscribers < 5.7.50 - Admin+ Stored XSS in Template
The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-43862: Improper Access Control
Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...
