46935 matches found
MINI-R658-WF9F-8V9W
Bulletin has no description...
MINI-F7R7-89QC-W82Q
Bulletin has no description...
MINI-96P9-CFPG-M86X
Bulletin has no description...
MINI-V673-CPMJ-VGRQ
Bulletin has no description...
MINI-PCQ6-CQ7F-R5VH
Bulletin has no description...
MINI-M24C-446P-84F8
Bulletin has no description...
MINI-F8GR-M753-G7RP
Bulletin has no description...
MINI-43PJ-9QVQ-HHR5
Bulletin has no description...
ECHO-81E4-B1FC-A9F9
Bulletin has no description...
ECHO-0EC6-0396-A56F
Bulletin has no description...
ECHO-90F5-FFF7-E790
Bulletin has no description...
ECHO-73AB-600D-62BE Caught by Cursor Bugbot review on PR #19827: the real vulnerability (GHSA-7xf9-4jfc-wgm4) is specific to Fine-Grained Admin Permissions V2's RealmPermissionsV2 treating manage-clients as equivalent to managing the special "admin-permissions" client, which then grants realm-wide admin power. RealmPermissionsV2 and the admin-permissions client concept do not exist in 25.0.6 — its older RealmPermissions.canManageAuthorizationDefault() has no per-ResourceServer parameter at all (it's a single, undifferentiated realm-wide check), so there is no "is this the special admin-permissions client" distinction for a narrow, upstream-faithful fix to attach to. An earlier patch here unconditionally removed MANAGE_CLIENTS from that check to close the described escalation, but that changes intended authorization behavior for every regular client's authorization management, not just a vulnerable path (upstream's real fix leaves the MANAGE_CLIENTS grant intact for non-admin-permissions clients) — reverted.
Bulletin has no description...
ECHO-6E54-DE1B-08C9
Bulletin has no description...
ECHO-A65A-C6E8-0F1D
Bulletin has no description...
ECHO-F035-45D7-D0F3
Bulletin has no description...
MINI-M826-28QR-7WCW
Bulletin has no description...
MINI-XP63-3C6H-36JQ
Bulletin has no description...
MINI-Q8W5-8PH5-6RP7
Bulletin has no description...