elgg is vulnerable to Authorization Bypass Through User-Controlled Key

elgg is vulnerable to Authorization Bypass Through User-Controlled Key...

GHSA-GWPX-Q2H9-WXGX elgg is vulnerable to Authorization Bypass Through User-Controlled Key

elgg is vulnerable to Authorization Bypass Through User-Controlled Key...

Authorization Bypass

elgg/elgg is vulnerablbe to authorization bypass. The vulnerability exists through the user-controlled key, userguid allowing unauthorized access to remote attackers...

CVE-2021-3964

elgg is vulnerable to Authorization Bypass Through User-Controlled Key...

CVE-2021-3964

elgg is vulnerable to Authorization Bypass Through User-Controlled Key...

CVE-2021-3964 Authorization Bypass Through User-Controlled Key in elgg/elgg

elgg is vulnerable to Authorization Bypass Through User-Controlled Key...

elgg 安全漏洞

Elgg is a set of open source social networking engine. The product blogs, file sharing, groups, and other features. A security vulnerability exists in elgg that stems from elgg's susceptibility to authorization bypass via a user-controlled key...

json-schema is vulnerable to Prototype Pollution

json-schema before version 0.4.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-41569

SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library included by default in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro...

Default credentials

SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library included by default in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro...

Symlink Attack

glib2 is vulnerable to symlink attack. The vulnerability exists due to a dangling symlink which incorrectly creates the target of the symlink as an empty file, which have security relevance if the symlink is attacker-controlled...

CVE-2021-30216

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in a customer-controlled product. Notes: none...

CVE-2021-30216

CVE-2021-30216 entry is rejected/not used; it does not represent an active vulnerability.

CVE-2021-25965

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery CSRF. By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application...

CVE-2021-3918

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

Code injection

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

CVE-2021-3918

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

Input validation

Jenkins Squash TM Publisher Squash4Jenkins Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an...

Mozilla: Javascript alert box could have been spoofed onto an arbitrary domain

Due to an unusual sequence of attacker-controlled events, a Javascript alert dialog with arbitrary although unstyled contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

Mozilla: Javascript alert box could have been spoofed onto an arbitrary domain

Due to an unusual sequence of attacker-controlled events, a Javascript alert dialog with arbitrary although unstyled contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...