GHSA-28WG-8GV4-MPJF Broken access control in Silverpeas

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

Broken access control in Silverpeas

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

Improper access control

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

PT-2023-30414

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 Description The issue is related to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. Recommendations For Silverpeas Core version 6.3.1, consider restricting...

CVE-2023-47321: Undefined Security Weakness

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

CVE-2023-47321

CVE-2023-47321 concerns Silverpeas Core 6.3.1, describing an Incorrect Access Control vulnerability via the Porlet Deployer that allows administrators to deploy .WAR portlets . The issue is characterized by a high integrity impact with no confidentiality or availability impact per the provided me...

Silverpeas Security Vulnerabilities

Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums, and document management. A security vulnerability exists in Silverpeas Core version 6.3.1, which stems from the vulnerability of the Porlet Deployer to incorrect...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

Unauthorized account can update policy of any account without a policy

Lines of code Vulnerability details Impact Unauthorized account can update policy of any account without a policy Proof of Concept if currentCommit == bytes320 && msg.sender == AddressProviderService.getAuthorizedAddressSAFEDEPLOYERHASH The argument passed into getAuthorizedAddress -...

registerWallet() does not validate the sender

Lines of code Vulnerability details Issue registerWallet in WalletRegistry.sol does not guarantee that the sender is the safe deployer. registerWallet should be called from the safe deployer, in the context of deployConsoleAccount // Register Wallet /// @dev This function is being packed as a par...

org.apache.camel:camel-example-cxf (2.4.0), org.apache.camel:camel-jetty (2.4.0) +32 more potentially affected by unknown CVE via org.eclipse.jetty:jetty-xml (7.1.4.v20100610)

org.eclipse.jetty:jetty-xml MAVEN version 7.1.4.v20100610 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-xml and may be impacted: - org.apache.camel:camel-example-cxf 2.4.0 - org.apache.camel:camel-jetty 2.4.0 -...

[Medium - 2] A force deployed contract may be stuck in the constructor forever

Lines of code Vulnerability details Impact The forceDeployOnAddress function in the ContractDeployer contract may be used to redeploy contracts at a specified address. Very useful in the case of precompiles or system contracts upgrades for instance. In the deployment parameters, multiple values c...

com.apica:apicaloadtest (>=1.1, <=1.10), com.infullmobile.jenkins.plugin:restricted-register (0.1.7) +4 more potentially affected by CVE-2023-27899 via org.jenkins-ci.main:jenkins-core (1.610)

org.jenkins-ci.main:jenkins-core MAVEN version 1.610 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.apica:apicaloadtest =1.1, =1.4, =1.7.2 - org.jenkins-ci.plugins:plugin 1.610 Source cves:...

com.apica:apicaloadtest (>=1.1, <=1.10), com.infullmobile.jenkins.plugin:restricted-register (0.1.7) +4 more potentially affected by CVE-2023-27904 via org.jenkins-ci.main:jenkins-core (1.610)

org.jenkins-ci.main:jenkins-core MAVEN version 1.610 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.apica:apicaloadtest =1.1, =1.4, =1.7.2 - org.jenkins-ci.plugins:plugin 1.610 Source cves:...

com.base2services.jenkins:github-sqs-plugin (>=1.0, <=1.5), org.jenkins-ci.main:jenkins-test-harness (1.451) +9 more potentially affected by CVE-2023-27901 via org.jenkins-ci.main:jenkins-core (1.451)

org.jenkins-ci.main:jenkins-core MAVEN version 1.451 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.base2services.jenkins:github-sqs-plugin =1.0, =2.4, =1.1, =1.3 Source cves: CVE-2023-27901...