CVE-2024-20837

Samsung Internet prior to version 24.0.0.41 contains an issue in how it grants permissions for Trusted Web Activities (TWAs). The vulnerability arises from improper handling of permission grants, enabling local attackers to grant permissions to their own TWA WebApps without user interaction. Affe...

IBM FileNet Content Manager Privilege Permission and Access Control Issues Vulnerability

IBM FileNet Content Manager is a content management solution for the FileNet P8 platform from International Business Machines IBM. The solution combines document management with ready-to-use workflow tools to manage images, video, Web content, compliance documents, and more. IBM FileNet Content...

IBM FileNet Content Manager 权限许可和访问控制问题漏洞

IBM FileNet Content Manager is a content management solution for the FileNet P8 platform from International Business Machines IBM. The solution combines document management with ready-to-use workflow tools to manage images, video, Web content, compliance documents, and more. IBM FileNet Content...

Mozilla: Potential permissions request bypass via clickjacking

The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...

Mozilla: Potential permissions request bypass via clickjacking

The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...

Mozilla: Potential permissions request bypass via clickjacking

The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S.A. Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is email client software that supports the IMAP and POP mail protocols as well as the HTML mail format. A...

CVE-2024-0750

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

krb5: double-free in KDC TGS processing

A vulnerability was found in MIT krb5, where an authenticated attacker can cause a KDC to free the same pointer twice if it can induce a failure in authorization data handling...

ODSafeManager#allowSAFE() cannot be executed either by the proxy contract or any other address.

Lines of code Vulnerability details Impact "According to the GEB framework, the proxy contracts ODProxy are designed to interact with the Safe Manager ODSafeManager through the Proxy Action contract BasicActions. The pivotal function, allowSAFE, is responsible for granting an address the capabili...

Mozilla: Potential permissions request bypass via clickjacking

The Mozilla Foundation Security Advisory describes this flaw as: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions...

Authorization Bypass

chromium is vulnerable to Authorization Bypasses. This vulnerability occurs when Chrome parses a specially crafted HTML page that contains a Web API permission prompt. If the page is valid, Chrome could be tricked into displaying the prompt in an unexpected way. This could allow the attacker to...

SUSE CVE-2023-4047

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox ESR is Firefox Enterprise Edition. A security bypass vulnerability exists in Mozilla Firefox and Firefox ESR, which can be exploited by attackers to trick users into granting privileges using...

UBUNTU-CVE-2023-4047

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

DEBIAN-CVE-2023-3326

pamkrb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket tgt from the Kerberos KDC Key Distribution Center over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pamkrb5 has no way to validate...

UBUNTU-CVE-2023-3326

pamkrb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket tgt from the Kerberos KDC Key Distribution Center over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pamkrb5 has no way to validate...

CVE-2023-3326 Network authentication attack via pam_krb5

pamkrb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket tgt from the Kerberos KDC Key Distribution Center over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pamkrb5 has no way to validate...

DEBIAN-CVE-2023-32207

A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

Granting the 'Administer Projects' permission to a 'Custom Field' within a permission scheme allows all users to see the Project Settings

h3. Issue Summary This is reproducible on Data Center: yes Granting the Administer Projects permission to a User custom field value results in users having access to the Project Settings area even when the field is not populated. h3. Steps to Reproduce Create a new project with sample data Create...