CVE-2025-24866 Unauthorized Access to User Activity Logs API by delegated granular administration roles

Mattermost versions 9.11.x = 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs...

CVE-2025-0422

An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. Remote Code Execution For this, the user must be able to create "ScriptVars" with the type „script" and preview them by, for example, creating a new "Info". By defaul...

PT-2025-6783 · Unknown · Bestinformed Web

Name of the Vulnerable Software and Affected Versions: BestInformed Web affected versions not specified Description: The issue allows an authenticated user in the BestInformed Web application to execute commands on the underlying server running the application, which is a case of remote code...

DRUPAL-CONTRIB-2024-052

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. In certain cases the module doesn't sufficiently sanitize data before passing it to PHP's unserialize function, which can result in arbitrary code execution...

Granular sudo Permissions for Management of Veeam Agent for IBM AIX

Purpose This article provides examples of granular 'sudo' configuration for the Linux account that will be used by Veeam Backup & Replication when managing Veeam Agent for IBM AIX deployments with a Protection Group. Solution The following granular sudo permissions were tested with Veeam Agent fo...

Granular sudo Permissions for Management of Veeam Agent for Oracle Solaris

Purpose This article provides examples of granular 'sudo' configuration for the Linux account that will be used by Veeam Backup & Replication when managing Veeam Agent for Oracle Solaris deployments with a Protection Group. Solution The following granular sudo permissions were tested with Veeam...

DRUPAL-CONTRIB-2024-045

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. A function which can be used by third-party code does not return valid data under certain rare circumstances. If the third-party code relies on this data to decide whether to grant...

Granular sudo Permissions for Management of Hardened Repository

Purpose This article documents the granular sudo permissions required to allow Veeam Backup & Replication to deploy and manage a Hardened Repository. Solution Account Requirements The Linux user account used by Veeam Backup & Replication to deploy and manage the Hardened Repository must use the...

[SECURITY] Fedora 40 Update: nginx-mod-naxsi-1.6-6.fc40

naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...

[SECURITY] Fedora 39 Update: nginx-mod-naxsi-1.6-6.fc39

naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...

Fedora: Security Advisory (FEDORA-2024-6ba57fd2a3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The Next Generation of RBI (Remote Browser Isolation)

The landscape of browser security has undergone significant changes over the past decade. While Browser Isolation was once considered the gold standard for protecting against browser exploits and malware downloads, it has become increasingly inadequate and insecure in today's SaaS-centric world...

Missing access control on critical functions

Lines of code Vulnerability details The broad admin role enables arbitrary manipulation of the heap without restrictions. Recommendation: Implement granular access control and privilege separation. Implement an access control system such as OpenZeppelin AccessControl to restrict access to these...

Building an AppSec Program with Qualys WAS – Additional Configurations and Review & Confirm

Part 4 - Configuring a Web Application or API: Additional Configurations Now that we have completed the basic information, crawl settings, and default scan configurations, we can shift our attention to additional configurations designed to optimize scanning and provide granular control over how...

Insecure and Inflexible Forwarder Approval Mechanism (Full Access Grant)

Lines of code Vulnerability details Impact The current implementation of the onlyApprovedForwarder modifier in the Ocean smart contract has several negative impacts: 1. Security Risk: Users are exposed to a significant security risk if their forwarder is compromised. An attacker can exploit full...

Elevating Enterprise API Security with Wallarm for MuleSoft Anypoint Platform

In an age characterized by digital transformation, APIs serve as the backbone of modern applications, enabling diverse systems to communicate and share data seamlessly. This widespread API adoption, however, exposes organizations to a considerable attack surface, inviting the attention of cyber...

Granular Log Collection Guide for SOBR Capacity/Archive Tier Issues

Purpose This article documents an advanced granular log collection method designed to minimize the log bundle size when submitting Veeam Support cases for issues related to the capacity tier or archive tier of a Scale-Out Backup Repository. The standard method of collecting logs for these cases i...

InsightIDR Launches Integration With New AWS Security Data Lake Service

It has been an action-packed day at AWS re:Invent. For security professionals, one of the most exciting announcements has to be the launch of Amazon Security Lake. We see a lot of potential for this new service, which is why Rapid7 is proud to announce the immediate availability of an integration...

CVE-2021-3414

A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing a user to view and manage other organizations are also granted. The highest threat from this vulnerability is to data confidentiality...

CVE-2021-3414

A flaw was found in satellite. When giving granular permission related to the organization, other permissions allowing a user to view and manage other organizations are also granted. The highest threat from this vulnerability is to data confidentiality...