CVE-2023-28649

The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability exists in which an attacker could impersonate a hub and send device requests to claim already claimed devices. The OvrC cloud platform receives the requests but do...

USN-5690-1 libxdmcp vulnerability

It was discovered that libXdmcp was generating weak session keys. A local attacker could possibly use this issue to perform a brute force attack and obtain another user's key...

CVE-2020-4138

IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174049...

Malicious user can indefinitely freeze the funds of another user

Lines of code Vulnerability details Impact By design, a user's cooldown period is extended if they receive a transfer of hPal. The cooldown is extended based on the weight of the receiver's original balance and cooldown period compared to the sent amount and sender's cooldown period. Due to this...

GitLab 跨站请求伪造漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A cross-site request forgery vulnerability exists in GitLab, which stems from ...

Bosch IP cameras 跨站请求伪造漏洞

Bosch IP cameras is a German Bosch web camera A security vulnerability exists in the web-based interface of Bosch IP cameras that allows an unauthenticated, remote attacker to trigger an action on behalf of another user on the affected system...

UBUNTU-CVE-2021-21326

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 it is possible to create tickets for another user with self-service interface without delegatee systems enabled. This is...

CVE-2019-4603

IBM Quality Manager RQM 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295...

Apple macOS Mojave EFI Component Authentication Vulnerability

Apple macOS Mojave is the operating system for Apple's line of Mac computers. An authentication vulnerability exists in the state management of the EFI component of Apple macOS Mojave, which can be exploited by an attacker to log in to another user account...

Lenovo System Interface Foundation Arbitrary Code Execution Vulnerability

The Lenovo System Interface Foundation is a collection of system services, drivers and plug-ins that support Lenovo Vantage applications. An arbitrary code execution vulnerability exists in Lenovo System Interface Foundation versions prior to 1.1.18.3. An attacker can exploit this vulnerability t...

Code injection

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158882...

CVE-2017-1693

IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before the session times out. IBM X-Force ID: 134164...

CVE-2017-1000438

In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the underlying filesystem, then manipulate the user's data...

Kanboard Design Vulnerability (CNVD-2017-30952)

Kanboard is a French software developer Frederic Guillot developed a set of open source visualization task board software. The software supports customization of the panel according to the business, task dragging and so on. A security vulnerability exists in Kanboard versions prior to 1.0.47. An...

CVE-2017-1352

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538...

Microsoft Windows HelpPane Elevation of Privilege Vulnerability

Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows HelpPane. When registering a DCOM object, the Windows COM session name does not properly implement the RunAs privilege, which can be...

Mobile Vikings: Stored xss in user name (2) affected another user.

Again we have to users: A - attacker B - victim User A attacker has name - namealert1 and add auth to user B victim. User B receive a letter and get remider about new request on website. And open it https://mobilevikings.com/account/requests/ And probably press "Accept" and got xss fired. x:confi...