443 matches found
eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
Ibexa DXP users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
GHSA-394J-X37R-2Q27 Ibexa DXP users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...
PT-2022-28244 · Unknown · Company Account Feature
Name of the Vulnerable Software and Affected Versions: Company account feature version 4 and later Description: A critical issue allows users with the Company admin role to assign any role to any user, bypassing subtree limitations. This also affects users with the role / assign policy, typically...
PT-2022-28186 · Unknown · Company Account Feature
Name of the Vulnerable Software and Affected Versions: Company account feature version 4 and later Description: A critical issue allows users with the Company admin role to assign any role to any user, bypassing subtree limitations. This also affects users with the role / assign policy, typically...
PT-2022-28178 · Unknown · Company Account Feature
Name of the Vulnerable Software and Affected Versions: Company account feature version 4 and later Description: A critical issue allows users with the Company admin role to assign any role to any user, bypassing subtree limitations. This also affects users with the role / assign policy, typically...
PT-2022-28268 · Unknown · Company Account Feature
Name of the Vulnerable Software and Affected Versions: Company account feature version 4 and later Description: A critical issue allows users with the Company admin role to assign any role to any user, bypassing subtree limitations. This also affects users with the role / assign policy, typically...
PT-2022-27179 · Picoc · Picoc
Name of the Vulnerable Software and Affected Versions: PicoC version 3.2.2 Description: A heap buffer overflow was discovered in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall, which can lead to a potential issue. Recommendations: For PicoC version 3.2....
Wedding Planner client_assign.php SQL Injection Vulnerability
Wedding Planner is a wedding planner project by pushpam abhishek. Designed to provide users with an easy way to plan their wedding through a web application while using real data. Wedding Planner v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of externally...
CVE-2022-40402
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/clientassign.php...
Wedding Planner SQL注入漏洞
Wedding Planner is a wedding planner project by pushpam abhishek. Designed to provide users with an easy way to plan their wedding through a web application while using real data. Wedding Planner v1.0 suffers from a SQL injection vulnerability that stems from a lack of validation of externally...
PT-2022-25366 · Unknown · Wedding Planner
Name of the Vulnerable Software and Affected Versions: Wedding Planner version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the booking parameter at the "/admin/client assign.php" API endpoint. Recommendations: For Wedding Planner...
ProcessMaker Privilege Escalation Exploit
Exploit Title: ProcessMaker - User Profile Privilege Escalation Description: ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators. Exploit Author: Sornram Kampeera...
Missing checks for Comptroller can block expected/correct flows getUnderlyingPrice
Lines of code Vulnerability details Missing checks for Comptroller can block expected/correct flows getUnderlyingPrice Summary Zero address should be checked to be avoided Also a 2 steps assign would help to not going wrong or a check within a whitelist Details getUnderlyingPrice would be blocked...
Malicious code in peep-assign (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3c18842912c86033a9768cc62560cee12e7606d14d03d1004361fe05fca2f99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5266 Malicious code in peep-assign (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3c18842912c86033a9768cc62560cee12e7606d14d03d1004361fe05fca2f99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
UBUNTU-CVE-2020-14321
In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course...
CVE-2021-40663
deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...
