Mattermost fails to properly enforce access controls for guest users

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

GHSA-HC6V-386M-93PQ Mattermost fails to properly enforce access controls for guest users

Mattermost versions 10.7.x = 10.7.0, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint...

Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems

Retrieval-Augmented Generation RAG systems, which integrate Large Language Models LLMs with external knowledge sources, are vulnerable to a range of adversarial attack vectors. This paper examines the importance of RAG systems through recent industry adoption trends and identifies the prominent...

PT-2025-23306 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.7.x through 10.7.0 Mattermost versions 10.5.x through 10.5.3 Mattermost versions 9.11.x through 9.11.12 Description: The issue is related to the failure of Mattermost to properly enforce access controls for guest users...

PT-2025-23170 · Maccms10 · Maccms10

Name of the Vulnerable Software and Affected Versions: maccms10 version 2025.1000.4047 Description: The issue is related to Server-side request forgery SSRF in Email Settings. This means that an attacker could potentially forge requests to internal or external services, bypassing normal security...

PT-2025-23676 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R version 1.0.0-B20230726.1108 Description: A vulnerability was found in the Parent Controls Page component of the affected software. The issue arises from the manipulation of the Device Name argument, leading to cross-site...

PT-2025-23080 · Johnson Controls · Istar Config Utility

Name of the Vulnerable Software and Affected Versions: Johnson Controls' iSTAR Config Utility versions prior to 6.9.5 Description: A memory leak flaw in the iSTAR Config Utility could lead to data leaks, potentially exposing sensitive information. The issue affects versions prior to 6.9.5. Updati...

Eliminate Risk with Precision: Introducing Vulnerability Detection Sources in VMDR

In the race against cyber threats, finding vulnerabilities is no longer enough. True security comes from understanding them—where they exist, how they were discovered, and what risks they pose. One of the most overlooked aspects in vulnerability management is knowing the source of detection...

CISA Releases One Industrial Control Systems Advisory

CISA released one Industrial Control Systems ICS advisory on May 27, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-146-01 Johnson Controls iSTAR Configuration Utility ICU Tool CISA encourages users and...

PT-2025-22875 · Unknown · Yangshare Warehousemanager 仓库管理系统

Name of the Vulnerable Software and Affected Versions: yangshare warehouseManager 仓库管理系统 version 1.0 Description: A vulnerability was found in the software, affecting an unknown part and leading to improper access controls. The manipulation can be initiated remotely. The exploit has been disclose...

CVE-2025-20242

A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise CCE could allow an unauthenticated, remote attacker to read and modify data on an affected device. This vulnerability is due to a lack of proper authentication controls. An attacker could exploit this...

CVE-2025-0783

A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use...

CVE-2025-24134

An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensitive data...

CVE-2024-47657

This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter dfclientid through API request URLs which could lead to unauthorized access to sensitive...

CVE-2024-9321

A vulnerability was found in SourceCodester Online Railway Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/inquiries/viewdetails.php. The manipulation of the argument id leads to improper access controls. The attack may be initiated...

CVE-2024-7714

The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatB...

CVE-2024-45588

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lea...

CVE-2024-45587

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which...

CVE-2024-27187

Improper Access Controls allows backend users to overwrite their username when disallowed...

CVE-2024-52359

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to improper access controls...