Missing Role Based Access Control for the REST handlers in bleve/http package

Impact What kind of vulnerability is it? Who is impacted? Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. https://github.com/blevesearch/bleve-explorer These HTTP methods paves way for exploitation of a node’s filesystem where the bleve index...

Authorization

Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP bleve/http handlers fo...

UBUNTU-CVE-2022-31022

Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP bleve/http handlers fo...

CVE-2022-31022

Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP bleve/http handlers fo...

CVE-2022-31022 Missing Role Based Access Control for the REST handlers in bleve/http package

Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP bleve/http handlers fo...

CVE-2022-31022 Missing Role Based Access Control for the REST handlers in bleve/http package

Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node’s filesystem where the bleve index resides, if the user has used bleve’s own HTTP bleve/http handlers fo...

Improper privilege management - Anyone can view room settings.

Description Hi bigbluebutton maintainers, I would like to report an improper privilege management, this allows anyone to view any room settings. Proof of Concept 1. To demonstrate the vulnerability, I've created a room https://demo.bigbluebutton.org/gl/hoa-j4s-sxx-5gn 2. Run this curl command to...

Zphisher-GUI-Back_office - A Zphisher GUI Back-Office Plugin

DISCLAIMER This toolkit contains materials that can be potentially damaging or dangerous for social media. Refer to the laws in your province/country before accessing, using,or in any other way utilizing this in a wrong way. This Tool is made for educational purposes only. Do not attempt to viola...

Exploit for Incorrect Calculation in Lighttpd

CVE-2022-30780 - lighttpd remote denial of service CVE-20...

Exploit for Improper Initialization in Linux Linux_Kernel

COMP3320-VAPT Files r...

Fedora: Security Advisory for golang-k8s-sample-apiserver (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-k8s-sample-apiserver-1.22.0-4.fc36

Demonstration of how to use the k8s.io/apiserver library to build a functional API server...

[SECURITY] Fedora 34 Update: golang-k8s-sample-apiserver-1.22.0-4.fc34

Demonstration of how to use the k8s.io/apiserver library to build a functional API server...

[SECURITY] Fedora 35 Update: golang-k8s-sample-apiserver-1.22.0-4.fc35

Demonstration of how to use the k8s.io/apiserver library to build a functional API server...

DEBIAN-CVE-2022-29537

gprtpbuilderdohevc in ietf/rtppckmpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box...

CVE-2022-29537

gprtpbuilderdohevc in ietf/rtppckmpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box...

Owners Collection Management System v1.0 SQL - Injection Vulnerability

Title: Owners Collection Management System v1.0 SQL - Injections Author: nu11secur1ty Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html Reference:...

Cross-site Scripting (XSS) - Stored

Description pimcore is vulnerable to Stored XSS at Title field in the SEO & Settings tab of a Document page. Payload " Step to reproduce 1.Go to https://demo.pimcore.fun/admin/ and login. 2.Click on any document Home, de,... in the Documents 3.Go to SEO & Settings tab, in the Title field, input...

An Armful of CHERIs

Today, Arm announced that the first silicon supporting the Morello prototype architecture, a research project led by Arm, Microsoft, University of Cambridge and others, is now available on a limited run of demonstration boards, which are being shipped from today to industry partners for testing...

Brave Software: Universal XSS with Playlist feature

A Universal XSS vulnerability was discovered in Brave iOS versions 1.32.3 and higher. The vulnerability was caused by three weaknesses, including the exposure of UserScriptManager.securityToken and UserScriptManager.messageHandlerToken, as well as a UXSS vulnerability in PlaylistHelper through...