1520 matches found
New Relic: removed user can still join the organization
hi, i would like to report an issue i have found that allow attacker to join organization even if the attacker is removed. i found out that when adding new user, if you add a new user without verifying the email address, you change the email of the user, the email address you initially send the...
CVE-2020-3542
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
CVE-2020-3542 Cisco Webex Training Unauthorized Meeting Join Vulnerability
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
CVE-2020-3542 Cisco Webex Training Unauthorized Meeting Join Vulnerability
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
CVE-2020-3542: Improper Input Validation
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
Cisco Webex Training Unauthorized Meeting Join Vulnerability
A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could explo...
GHSA-67J9-C52G-W2Q9 Authorization Bypass in I hate money
Impact An authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default...
OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...
OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117)
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...
CVE-2020-15779
A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path...
CVE-2019-20893
An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11. PartyHostHandleJoinPartyRequest has a buffer overflow vulnerability and can be exploited by using a crafted joinParty packet. This can be utilized to conduct arbitrary code execution on a victim'...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41490)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.8.0 that stems from the program not following domain name requirements when processing join requests for public teams. An...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-41174)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.8.1, 4.7.4 and 4.6.3. An attacker can use this vulnerability to obtain the inviteid of a team and then repeatedly ask...
CVE-2019-20882
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team...
CVE-2019-20882
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team...
CVE-2019-20882
Mattermost Server before 5.8.0 does not honor the domain requirement when processing a join request for an open/public team. Root cause: domain validation in the join flow is insufficient, enabling potential unauthorized joining of public teams (exploit described in CNVD/DOCs). Affected version r...
PT-2020-10846
Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.8.0 Description An issue was discovered where the Mattermost Server does not honor the domain requirement when processing a join request for an open team. Recommendations For versions prior to 5.8.0, updat...
CVE-2019-20882: Incorrect Default Permissions
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team...