Broken access control in Silverpeas

Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces...

GHSA-42G3-3JWM-63RX Broken access control in Silverpeas

Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces...

CVE-2023-47322

The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery CSRF leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user ...

Improper access control

The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL...

com.sap.cds:cds-feature-identity (>=2.0.1, <=2.4.0), com.sap.cds:cds-starter-cloudfoundry (>=2.2.0, <=2.4.0) +7 more potentially affected by CVE-2023-50422 +1 more via com.sap.cloud.security:java-security (>=3.0.0, <=3.2.1)

com.sap.cloud.security:java-security MAVEN version =3.0.0, =2.0.1, =2.2.0, =2.2.0, =1.0.4, =1.0.4, =1.0.4, =3.0.0, =3.0.0, =3.0.0, =3.2.1 Source cves: CVE-2023-50422, CVE-2023-50424 Source advisory: OSV:GHSA-59C9-PXQ8-9C73...

PT-2023-30417

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 and prior Description The issue is related to Cross Site Scripting XSS via the message/notification feature. This allows for potential malicious script execution. No information is provided about the estimated...

PT-2023-30416

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 Description The notification/messaging feature does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users, including those sent only to administrator...

CVE-2023-47324

Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting XSS via the message/notification feature...

PT-2023-32766 · Sourcecodester · Sourcecodester Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Tours & Travels Management System version 1.0 Description: A critical issue affects the function prepare of the file email setup.php. The manipulation of the argument name leads to SQL injection. The exploit has been...

CVE-2023-47323

The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators...

PT-2023-23382 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.0.3 Description: The issue allows attackers to run arbitrary code via the search feature. This is a Cross Site Scripting XSS issue, which means attackers can execute scripts in the context of another user's session,...

CVE-2023-47325: Improper Access Control

Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the spaces...

CVE-2023-47324

Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting XSS via the message/notification feature...

Silverpeas Security Vulnerabilities

Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums and document management. A security vulnerability exists in Silverpeas Core version 6.3.1, which stems from the vulnerability of the Bin feature to corrupted acce...

PT-2023-30418

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 Description The administrative "Bin" feature in Silverpeas Core is affected by broken access control, allowing a user with low privileges to navigate directly to the bin. This reveals all deleted spaces, which the...

Directory traversal

The package-decompression feature in HL7 Health Level 7 FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists...

CVE-2023-5536

A feature in LXD LP1829071, affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to root without requiring a sudo password...

com.sap.cds:cds-feature-identity (>=2.0.1, <=2.4.0), com.sap.cds:cds-starter-cloudfoundry (>=2.2.0, <=2.4.0) +7 more potentially affected by CVE-2023-50422 via com.sap.cloud.security:java-security (>=3.0.0, <=3.2.1)

com.sap.cloud.security:java-security MAVEN version =3.0.0, =2.0.1, =2.2.0, =2.2.0, =1.0.4, =1.0.4, =1.0.4, =3.0.0, =3.0.0, =3.0.0, =3.2.1 Source cves: CVE-2023-50422 Source advisory: MEND:CVE-2023-50422...

APSB23-72 : Security update available for Adobe Experience Manager

Adobe has released updates for Adobe Experience Manager AEM. These updates resolve vulnerabilities rated important and moderate. Successful exploitation of these vulnerabilities could result in arbitrary code execution and security feature bypass...

Health Level 7 Security Vulnerability

Health Level 7 is a series of global standards for transferring clinical and administrative health data between applications from Health Level 7, Inc. A security vulnerability exists in Health Level 7 versions prior to 5.6.106 that stems from a package decompression feature in the core library th...